SnappyClient Implant Blends Remote Access, Data Theft, and Stealth Evasion

Zscaler ThreatLabz documents "SnappyClient," a sophisticated C++ C2 implant delivered via the HijackLoader loader (observed in a phishing campaign impersonating Telefónica O2) that performs credential and crypto wallet theft, remote access, and extensive evasion (AMSI bypass, Heaven’s Gate/syscalls, transacted hollowing). The analysis details its encrypted ChaCha20-Poly1305 control/data protocol, embedded and remote configs, wide-ranging theft and remote-control capabilities, code overlaps with HijackLoader, provided SHA256 IOCs, and mitigation recommendations focused on loader detection, AMSI integrity, process-injection behavior, and browser/clipboard monitoring.