Kiss Loader Malware Employs Early Bird APC Injection in New Attack Campaign

A new malware loader, dubbed Kiss Loader, has been identified by cybersecurity researchers, employing sophisticated code injection techniques to compromise Windows systems undetected. Discovered in early March 2026, Kiss Loader represents a nascent attack campaign still under active development by its creators. The malware’s initial distribution vector involves a Windows Internet Shortcut file (.url) ingeniously disguised as a PDF document, leading victims to a remote server hosted via a legitimate TryCloudflare tunnel, a method that allows for stealthy and flexible payload delivery.

G DATA analysts stumbled upon Kiss Loader during a routine investigation, noting its novelty in the wild and its custom-built nature for this specific campaign. The researchers observed that the attacker’s WebDAV file hosting directory was unsecured, further indicating the threat actor’s ongoing work on the loader when it was first brought to light. This unsecured access allowed for easy modification and swapping of malicious files, significantly complicating efforts to track and neutralize the ongoing threat.

Once executed on a targeted system, Kiss Loader initiates a multi-stage infection process. A batch script establishes persistence by placing a file in the Windows Startup folder, ensuring the malware runs automatically upon system reboots. Simultaneously, a decoy PDF is presented to the user to deflect suspicion. Additional malicious components are downloaded silently in the background. These downloaded archives contain a Python-based loader designed to decrypt embedded payloads using keys extracted from JSON configuration files, thereby concealing the malicious code until its final stage of execution.

During their analysis, researchers recovered two distinct payloads: VenomRAT, identified as a remote access tool similar to AsyncRAT, and Kryptik, a .NET Reactor-protected file. In a remarkable instance of direct interaction, a G DATA researcher posed a question to the threat actor via a Notepad message within a controlled analysis environment. Approximately an hour later, the attacker responded, confirming their presence on the compromised machine and acknowledging the deliberate inclusion of the Early Bird APC injection technique within the Kiss Loader’s architecture.

Early Bird APC Injection: How Kiss Loader Evades Detection

The primary mechanism enabling Kiss Loader’s stealth is its implementation of Early Bird APC injection. This evasion technique involves injecting the malware’s payload into a legitimate, trusted Windows process, thereby masking its malicious activity as normal system operations. The loader specifically targets the `explorer.exe` process, a core component of the Windows graphical interface, making it exceptionally difficult for security solutions to distinguish malicious actions from legitimate ones.

Kiss Loader initiates this injection by launching `explorer.exe` in a suspended state, preventing it from executing its normal functions immediately. The loader then allocates memory space within this suspended process and writes the decrypted shellcode into it. Instead of creating a new thread, which is a common target for security monitoring, Kiss Loader queues an Asynchronous Procedure Call (APC) to the suspended process’s primary thread. When the `explorer.exe` process resumes execution, the APC is processed first, running the malicious shellcode before the legitimate Explorer functionalities commence, all within the trusted context of the system process.

The shellcode itself is reportedly generated using Donut, an open-source tool capable of converting .NET assemblies into memory-only shellcode. This approach eliminates the need to write any malicious code directly to disk, significantly hindering the effectiveness of traditional antivirus software. The detailed runtime output logs captured during analysis also confirmed that the malware was still undergoing testing and refinement at the time of its discovery.

To mitigate the risks associated with Kiss Loader and similar advanced threats, users are strongly advised to exercise caution and avoid opening `.url` files from unverified or untrusted sources, as this represents the malware’s primary entry point. Security teams should enhance their Endpoint Detection and Response (EDR) solutions to detect APC-based injection attempts targeting critical processes such as `explorer.exe`. Monitoring outbound network connections to TryCloudflare domains can also provide early indicators of compromise. Furthermore, administrators should enforce proper authentication and access controls on WebDAV directories to prevent their misuse for hosting malicious payloads. Maintaining up-to-date Windows operating systems and installed software is crucial for patching vulnerabilities that attackers might exploit by weaponizing built-in system functionalities.

Indicators of Compromise (IoCs) include the following files and hashes:

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.