Spoofed GlobalProtect Used to Deliver Unique WikiLoader Variant

Unit 42 describes an active WikiLoader (WailingCrab) campaign that uses SEO poisoning to serve spoofed GlobalProtect installers which sideload malicious DLLs, decrypt and inject shellcode, establish persistence, and communicate with C2 infrastructure (including MQTT brokers and compromised WordPress sites). The report details delivery and execution steps, anti-analysis and evasion techniques (DLL sideloading, encrypted shellcode, hashed VM checks, fake error dialogs), provides numerous IOCs (delivery URLs, C2 URLs, SHA-256 hashes), and supplies XQL hunting queries and mitigations for detection and response.