OysterLoader Multi‑Stage Evasion Loader Uncovered with Advanced Obfuscation and Rhysida Ransomware Links

OysterLoader is a sophisticated multi-stage malware loader distributed via fake, digitally signed MSI installers that employs steganography, RC4-encrypted payloads hidden in icon files, timing- and API-based anti-analysis, and scheduled-task persistence to deliver ransomware (Rhysida) and infostealers (e.g., Vidar); analysts observed two-tier C2 infrastructure and evolving obfuscation techniques that complicate detection and network analysis.