Hackers Use OnionDrop Loader With DLL Sideloading to Deploy Multiple Infostealers

A high-tempo campaign is using a professionally engineered loader called OnionDrop — delivered via Adobe-signed executable DLL sideloading — to distribute multiple infostealers (LegionLoader, CGrabber, Vidar). The report documents a multi-stage unpack/decrypt pipeline (custom byte-pair decoding, Xpress Huffman, AES-256-CBC, Donut shellcode), evasion TTPs (NtCreateThreadEx, Thread Pool callback registration, API name obfuscation, GPU whitelist checks), YARA retro-hunting that found 645+ unique DLL samples, and provides IOCs (C2 gainmsg.com and numerous SHA256 hashes) and detection guidance.