Experts Uncover New Evasive SquidLoader Malware Targeting Chinese Organizations

AT&T LevelBlue Labs discovered SquidLoader, an evasive malware loader observed in April 2024 that spreads through phishing attachments disguised as Word binaries and fetches in-memory second-stage shellcode (including Cobalt Strike). The loader uses multiple anti-analysis and evasion techniques—encrypted code segments, unused/dead code, control-flow obfuscation, debugger detection, and direct syscalls—to avoid detection and hinder analysis; the report also references related loader families (Taurus Loader, PikaBot, Latrodectus) and recent infrastructure disruptions by law enforcement.