Kiss Loader Malware Targets with Early Bird APC Injection in New Attack Campaign

A newly identified malware loader dubbed “Kiss Loader” is emerging as a potential threat, leveraging advanced process injection techniques and dynamic delivery infrastructure.

The loader, still under active development at the time of discovery, demonstrates a blend of stealth, modular staging, and experimental implementation, suggesting it may evolve into a more mature attack tool.

When executed, the file connects to a remote WebDAV resource hosted via a TryCloudflare tunnel. This service allows attackers to expose local servers without dedicated infrastructure, enabling flexible and frequently updated payload delivery.

Analysis of the sample reveals a structured, multi-stage execution flow. The infection begins with a Windows Internet Shortcut file disguised as a PDF document.

Within the exposed WebDAV directory, a secondary shortcut file triggers further execution. This leads to a Windows Script Host (WSH) process, which chains into a JScript component.

This layered execution approach helps obscure the later stages of the attack and reduces immediate detection.

Kiss Loader Malware

The JScript stage retrieves a batch script responsible for orchestrating the next phase. This script performs multiple functions, including displaying a decoy PDF to the victim, establishing persistence through the Windows Startup folder, and downloading additional payload components.

The exposed WebDAV directory lacked access restrictions, which allowed me to directly enumerate and retrieve its contents.

Among these components is a Python-based loader identified as “Kiss Loader.” The loader uses JSON configuration files to retrieve decryption keys, ensuring that payloads remain encrypted until runtime. This design complicates static analysis and enhances evasion.

The decrypted payloads include a variant resembling VenomRAT or AsyncRAT, along with a .NET Reactor–protected utility.

The shellcode used in execution is generated via Donut, a tool designed for in-memory execution of .NET assemblies.

The final stage of execution relies on Early Bird APC injection, a stealthy process injection technique. The loader creates a legitimate process, such as explorer.exe, in a suspended state. It then allocates executable memory within the process and writes the decrypted shellcode.

Instead of spawning a new thread, the malware queues an Asynchronous Procedure Call (APC) to the primary thread.

When the thread resumes, the queued APC executes before normal process initialization, allowing the malicious code to run under a trusted process context. This significantly improves stealth and bypasses conventional detection mechanisms.

Signs of Active Development

Several indicators suggest that Kiss Loader is still in a development phase. The WebDAV repository used for payload delivery was publicly accessible and lacked authentication controls, allowing direct enumeration of hosted files.

Observations show that the files were recently deployed, indicating an ongoing campaign setup.

Additionally, the loader’s code contains extensive inline comments explaining core routines such as decryption and injection.

The presence of testing utilities, helper functions, and verbose runtime output further supports the conclusion that the malware is being actively tested and refined.

During controlled analysis, an unexpected event occurred: the system appeared to be actively accessed by an external operator. Tools were abruptly terminated, and cursor movement was observed without user input.

In a controlled experiment, a message left in a Notepad window received a response, confirming live interaction with the threat actor.

The individual acknowledged developing the malware and confirmed the use of Early Bird injection. The interaction, though brief, provided rare real-time insight into the development process and attacker intent.

Kiss Loader highlights the increasing sophistication of loader-based malware and the growing use of flexible infrastructure like Cloudflare.

Its use of layered execution, encrypted payload staging, and advanced injection techniques underscores its potential as a future threat.

The case also serves as a reminder that malware analysis can occasionally extend beyond code, revealing the human element behind cyber threats.

As attackers continue to experiment and adapt, maintaining strict isolation and controlled environments remains critical for safe and effective analysis.

IOCs

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.