HijackLoader Evolves: Researchers Decode the Latest Evasion Methods

HijackLoader (aka IDAT Loader) is an actively used modular malware loader that has adopted advanced defense-evasion techniques — including process doppelgänging, variants of process hollowing, Heaven's Gate, and transacted hollowing — and is being leveraged by criminal groups (e.g., TA544) to deliver payloads such as DanaBot, SystemBC, Remcos RAT, and RedLine Stealer, increasing its stealth and complicating analysis.