Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control Communication

A sophisticated multi-stage infection chain was identified through proactive threat hunting, beginning with the execution of MicrosoftToolkit.exe, a commonly abused hack tool. The attack employed file masquerading techniques, renaming a .dot file to .bat format to evade detection. The malware performed process discovery and attempted to terminate security-related processes before extracting payloads using extract32.exe. An AutoIt-compiled executable (Replies.scr) functioned as a loader, processing an external encrypted payload file and establishing command-and-control communication with infrastructure associated with Vidar Stealer. The malware demonstrated advanced anti-analysis capabilities, including debugger detection and instrumentation callback queries. It targeted credentials, browser data, cryptocurrency wallets, and system information. Post-execution cleanup routines deleted artifacts and terminated processes to minimize forensic evidence and evade detection, significantly complicating incident res...

• 2CLoader: A New Malware Loader Delivering Vidar and RemusMalware2026-09-30
• Case of AgentTesla Malware Distribution Disguised as a Business Proposal EmailMalware2026-10-14
• RemusStealer: EtherHiding In Hidden WindowsMalware2026-10-02
• False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking AppsMalware2026-10-28
• September 2026 Infostealer Trend ReportMalware2026-10-28