The Malware That Chats Back: Inside G DATA’s Real-Time Notepad Encounter with the “Kiss Loader” Author

Kiss Loader is a Python-based loader delivered via a deceptive Windows Internet Shortcut that fetches payloads from a TryCloudflare-hosted WebDAV, persists via the Startup folder, decrypts Donut-generated shellcode, and performs Early Bird APC injection into a suspended legitimate process to run payloads (VenomRAT and a .NET utility). The analysis uniquely documented a real-time Notepad conversation with the apparent author, confirming development activity and use of the described techniques.