Technical Analysis of SnappyClient In December 2025 Zscaler ThreatLabz discovered SnappyClient, a C++-based command-and-control implant delivered via HijackLoader that provides remote access, keylogging, screenshot capture, browser/extension and application data theft, and targeted cryptocurrency theft. The implant uses multiple evasion techniques (AMSI bypass, Heaven’s Gate, direct syscalls, transacted hollowing), a custom ChaCha20-Poly1305 encrypted protocol, and configurable EventsDB/SoftwareDB payloads—strongly suggesting ties between SnappyClient and HijackLoader. #SnappyClient #HijackLoader

In Dec 2025, Zscaler ThreatLabz uncovered SnappyClient, a C++ implant delivered via HijackLoader with advanced evasion, encrypted comms, and capabilities like keylogging, data theft, and crypto targeting. #SnappyClient #HijackLoader #USA

SnappyClient C2 Analysis

~Zscaler~
Zscaler analyzed SnappyClient, a new C++ C2 implant delivered via HijackLoader, featuring AMSI bypass, crypto theft, and remote access.
-
IOCs: SnappyClient, HijackLoader
-
#Malware #SnappyClient #ThreatIntel