LokiBot Resurfaces in Sophisticated Multi-Stage Credential Theft Campaign
LokiBot, one of the longest-active credential-stealing malware families, has reemerged in a new campaign combining legacy techniques with modern evasion tactics. First advertised in 2015 by threat actors "lokistov" and "carter," the malware gained traction after its source code leaked in 2018, leading to forks with expanded capabilities, including Android support, keylogging, and remote access. Today, LokiBot targets credentials from over 100 applications, including browsers, cryptocurrency wallets, email clients, and FTP tools.
Security researchers at LevelBlue uncovered the latest campaign, which begins with a phishing email containing a malicious JScript attachment. When executed, the obfuscated script triggers a multi-stage infection chain designed to evade detection and erase traces if interrupted. The attack proceeds as follows:
- Initial Execution: The JScript file runs via Windows Script Host, decoding a Base64-encoded PowerShell script stored in C:\Temp under a random filename.
- Payload Delivery: The PowerShell script decrypts a .NET assembly using XOR encryption, loading it directly into memory to avoid disk-based detection. The assembly, obfuscated with ConfuserEx, acts as an injector.
- Process Injection: The malware spawns a legitimate aspnet_compiler.exe process, injecting the final LokiBot payload into its memory space a technique that blends malicious activity with trusted system processes.
- Credential Theft: Once active, LokiBot creates a mutex (using the MD5 hash of the machine’s registry ID) to prevent duplicate infections. It then harvests credentials from targeted applications, compresses the stolen data with aPLib, and exfiltrates it to a command-and-control (C2) server via 3DES-encrypted communication.
- Persistence Attempts: While newer samples include a broken persistence mechanism due to a flawed decryption routine, the malware still attempts to establish a foothold via registry run keys.
The campaign’s C2 infrastructure includes domains such as kbfvzoboss.bid, alphastand.trade, and the IP address 158.94.211.95, with exfiltration endpoints like http://158.94.211.95/kelly/five/fre.php. LokiBot’s stealth is further enhanced by runtime API resolution (avoiding direct imports) and reflective loading to bypass traditional detection methods.
Despite its age, LokiBot remains a persistent threat due to its low cost, ease of use, and continuous evolution. Successful infections grant attackers access to sensitive credentials, enabling account takeovers, data theft, and further compromise of individuals and organizations. LevelBlue’s analysis highlights the malware’s adaptability, blending obfuscation, process injection, and memory-resident execution to evade modern defenses.
Source: https://cybersecuritynews.com/lokibot-campaign-uses-jscript-attachment/
LevelBlue cybersecurity rating report: https://www.rankiteo.com/company/levelbluecyber
"id": "LEV1782397631",
"linkid": "levelbluecyber",
"type": "Cyber Attack",
"date": "5/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'attack_vector': 'Phishing Email with Malicious JScript Attachment',
'data_breach': {'data_encryption': '3DES (for exfiltration)',
'data_exfiltration': 'Yes (to C2 server via 3DES-encrypted '
'communication)',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Credentials, Personally '
'Identifiable Information (PII)'},
'description': 'LokiBot, one of the longest-active credential-stealing '
'malware families, has reemerged in a new campaign combining '
'legacy techniques with modern evasion tactics. The malware '
'targets credentials from over 100 applications, including '
'browsers, cryptocurrency wallets, email clients, and FTP '
'tools. The latest campaign begins with a phishing email '
'containing a malicious JScript attachment, triggering a '
'multi-stage infection chain designed to evade detection and '
'erase traces if interrupted.',
'impact': {'data_compromised': 'Credentials from over 100 applications '
'(browsers, cryptocurrency wallets, email '
'clients, FTP tools)',
'identity_theft_risk': 'High',
'payment_information_risk': 'High'},
'initial_access_broker': {'entry_point': 'Phishing Email with Malicious '
'JScript Attachment'},
'investigation_status': 'Ongoing',
'lessons_learned': "LokiBot's adaptability and use of modern evasion tactics "
'(obfuscation, process injection, memory-resident '
'execution) highlight the need for advanced detection '
'mechanisms and continuous monitoring.',
'motivation': 'Credential Theft, Data Exfiltration, Financial Gain',
'post_incident_analysis': {'corrective_actions': 'Enhance email security, '
'deploy EDR solutions, '
'monitor for C2 '
'communications, employee '
'training',
'root_causes': 'Phishing email with malicious '
'attachment, lack of advanced '
'detection for process injection '
'and memory-resident malware'},
'recommendations': ['Implement advanced email filtering to block malicious '
'attachments',
'Deploy endpoint detection and response (EDR) solutions '
'to detect process injection and memory-resident malware',
'Monitor for unusual outbound traffic to known C2 '
'domains/IPs',
'Educate employees on phishing risks and safe email '
'practices',
'Regularly update and patch systems to mitigate known '
'vulnerabilities'],
'references': [{'source': 'LevelBlue'}],
'response': {'third_party_assistance': 'LevelBlue'},
'threat_actor': ['lokistov', 'carter'],
'title': 'LokiBot Resurfaces in Sophisticated Multi-Stage Credential Theft '
'Campaign',
'type': 'Malware Campaign'}