CoffeeLoader Malware Is Stacked With Vicious Evasion Tricks

CoffeeLoader is a highly evasive Windows malware loader used as a second-stage payload for SmokeLoader to deliver the Rhadamanthys infostealer. Zscaler ThreatLabz documents multiple advanced evasion techniques — including stack spoofing, sleep obfuscation (with optional Windows fibers), and a GPU-based packer dubbed “Armoury” that uses OpenCL — as well as a domain generation algorithm for backup C2 resilience, indicating a clear escalation in attacker sophistication aimed at bypassing EDRs and forensic tools.