GHOSTPULSE haunts victims using defense evasion bag o' tricks

Elastic Security Labs documents the GHOSTPULSE campaign that uses signed MSIX installers and sideloading to deliver a multi-stage, stealthy loader which decrypts and injects final payloads (information-stealers and RATs). The report provides a stage-by-stage technical analysis (PowerShell/GPG dropper, side-loaded DLL extracting encrypted blobs, module stomping, NT syscall invocation, process doppelgänging), associated IOCs (domains, IPs, file hashes, code signers), detection guidance, and a configuration extractor for researchers.