LegionLoader malware is distributed through social engineering involving fake CAPTCHA pages that prompt users to execute PowerShell commands. Distribution occurs via malicious URLs on a Korean wiki page and spear phishing emails impersonating internal business communications. Upon execution, LegionLoader decrypts encrypted shellcode and PE files, performs environment checks including display device and ASN verification, then deploys backdoor malware capable of running PE files, shellcode, PowerShell scripts, and MSI files. It also exfiltrates Chrome browser credentials and profile information as directed by its C2 server.

Successful infection results in a persistent backdoor on the victim system, enabling execution of arbitrary payloads including executables, scripts, and shellcode. Additionally, the malware steals sensitive browser credentials and profile data, potentially compromising user accounts and privacy.

No official patches or fixes are available as this is malware distributed via social engineering. Mitigation focuses on user awareness to avoid clicking suspicious links and executing unexpected PowerShell commands. Organizations should educate users about spear phishing tactics and verify unexpected internal communications. Endpoint detection and response solutions should be employed to detect and block execution of suspicious PowerShell commands and known LegionLoader indicators.