New SnappyClient Implant Combines Remote Access, Data Theft and Advanced Evasion
The SnappyClient malware implant poses a significant risk to Windows users, integrating remote access, data theft, and advanced evasion capabilities within a single C++ package.
The SnappyClient malware implant poses a significant risk to Windows users, integrating remote access, data theft, and advanced evasion capabilities within a single C++ package.
Initially identified in December 2025, this command-and-control (C2) framework can log keystrokes, capture screenshots, initiate a remote terminal, and extract sensitive data from browsers and applications, all while circumventing security tools .
The attack commences with a fraudulent website masquerading as Telefónica, targeting German-speaking users by delivering a HijackLoader download. Upon execution, HijackLoader decrypts and loads SnappyClient into memory.
In February 2026, a second delivery method was utilized, employing a ClickFix trick via X (formerly Twitter), deploying SnappyClient through GhostPulse and HijackLoader.
The attack commences with a fraudulent website masquerading as Telefónica, targeting German-speaking users by delivering a HijackLoader download.
SnappyClient communicates with its C2 server over TCP using a custom protocol. Communication is compressed with the Snappy algorithm and encrypted with ChaCha20-Poly1305, complicating network traffic analysis.
Browsers: Chrome, Firefox, Edge, Opera, and Brave. Cryptocurrency Extensions: MetaMask, Phantom, TronLink, Coinbase Wallet, TrustWallet. Crypto Applications: Exodus, Atomic, Electrum, Ledger Live.
SnappyClient monitors and manipulates Windows' LoadLibraryExW function, disabling the Windows Antimalware Scan Interface by patching AmsiScanBuffer and AmsiScanString . It uses Heaven's Gate to switch between 32-bit and 64-bit modes, bypassing user-mode API hooks.
The malware registers a scheduled task and writes an autorun entry under Software\Microsoft\Windows\CurrentVersion\Run . It encrypts sensitive files with ChaCha20 for enhanced security.
Avoid downloading executables from unverified sources. Monitor for unusual scheduled tasks and registry changes. Ensure endpoint detection rules cover Heaven's Gate execution. Keep browsers updated and audit installed extensions regularly.
Based on reporting by Cyber Security News.