Kiss Loader Malware Targets with Early Bird APC Injection in New Attack Campaign

Kiss Loader is a newly discovered, actively developed multi-stage loader that leverages open WebDAV delivered via Cloudflare tunnels to stage encrypted payloads, uses WSH/JScript and Python components to deploy and decrypt payloads (including RAT variants), and achieves stealthy in-memory execution through Donut-generated shellcode and Early Bird APC injection; the analysis documents live operator interaction and provides multiple IOCs.