SquidLoader Malware Campaign Targets Hong Kong Financial Sector

A new campaign using SquidLoader targets financial institutions in Hong Kong with Mandarin spear-phishing emails containing password-protected RARs; the malicious PE masquerades as a Word-related binary, self-unpacks, dynamically resolves APIs, and employs extensive anti-analysis and sandbox-evasion techniques before contacting C2 infrastructure to download a Cobalt Strike Beacon and establish persistent remote access. Organizations are advised to strengthen email filtering, endpoint monitoring, and behavioral detection to mitigate risk.