GachiLoader: Defeating Node.js Malware with API Tracing

A new malware distribution campaign utilizing compromised YouTube accounts to spread infostealers has been identified. The campaign employs GachiLoader, a heavily obfuscated Node.js loader, to deploy the Rhadamanthys infostealer. GachiLoader implements anti-analysis techniques and uses a novel PE injection method called Vectored Overloading. To aid analysis, researchers developed an open-source Node.js tracer tool. The campaign has affected over 100 videos with 220,000 views across 39 compromised accounts since December 2024. The malware evades detection, elevates privileges, and disables Windows Defender before retrieving its payload.

• Case of AgentTesla Malware Distribution Disguised as a Business Proposal EmailMalware2026-10-14
• Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution ChainMalware2026-10-25
• Technology that blocks DGA domains | Kaspersky official blogAnalysis2026-10-23
• Infostealer riding the AI TrainMalware2026-10-23
• LiteLLM release pipeline hacked to distribute info-stealer malwareMalware2026-10-22