New TicTacToe Dropper Steals Data, Spreads Multiple Threats on Windows

FortiGuard Labs identified a multi-stage Windows malware loader dubbed the TicTacToe dropper that has been active across 2023–2024 and drops multiple final-stage payloads (AgentTesla, LokiBot, Remcos, and others). The dropper uses .iso delivery to evade detection, extracts nested DLL layers at runtime, and employs obfuscation tools (DeepSea, SmartAssembly) and reflective loading; researchers note dynamic string changes and recommend behavior-based EDR for new campaigns.