Hijack Loader Malware Employs Process Hollowing, UAC Bypass in Latest Version

A technical report describes an updated variant of the Hijack Loader (IDAT Loader) observed in March–April 2024 that incorporates multiple new anti-analysis and evasion techniques — including Windows Defender exclusions via PowerShell, UAC bypass, process hollowing, Heaven's Gate to evade user-mode hooks, and decrypting/parsing PNG files to load a second-stage payload — and is being used to deliver information stealers (Amadey, Lumma, Meta, Racoon) and RATs (Remcos, Rhadamanthys) across campaigns.