ZLoader Malware Evolves with Anti-Analysis Trick from Zeus Banking Trojan

ZLoader (aka Terdot/DELoader) has resurfaced with active development: recent versions add RSA encryption, DGA updates, and a new anti-analysis feature that binds execution to the originally infected host via per-sample Registry and MZ-header checks, making analysis and re-hosting difficult. Separately, threat actors use fraudulent websites hosted on legitimate platforms and black-hat SEO to distribute stealers, and phishing campaigns have been observed delivering Taskun as a loader for Agent Tesla across multiple countries.