CoffeeLoader Malware Loader Linked to SmokeLoader Operations

CoffeeLoader is a newly identified malware loader tracked since September 2024 that deploys second-stage payloads while employing advanced evasion techniques — including a GPU-based packer that mimics ASUS Armoury Crate, call stack spoofing, sleep-state memory encryption, Windows-fiber based obfuscation, process injection, and scheduled-task persistence — and communicates with HTTPS C2 servers using certificate pinning; it has been observed in conjunction with SmokeLoader and presents a significant risk to endpoint detection and response systems.