SnappyClient Implant Blends Remote Access, Data Theft, and Stealth Evasion

A powerful new C2 implant called SnappyClient that blends remote access, credential theft, and stealthy evasion into a single, modular framework targeting Windows systems and cryptocurrency users.​

ThreatLabz first observed SnappyClient in December 2025, being deployed via the well-known HijackLoader malware family.

SnappyClient is written in C++ and operates as a flexible command-and-control implant, supporting capabilities such as screenshots, keylogging, remote shell access, and large-scale data theft from browsers, extensions, and desktop applications.

In the primary campaign documented by researchers, attackers used a phishing website impersonating Telefónica’s O2 brand in German to automatically deliver a HijackLoader executable, which then decrypted and loaded SnappyClient into memory.

Zscaler ThreatLabz identified a new command-and-control (C2) framework implant that we track as SnappyClient, which was delivered using HijackLoader.

Additional delivery chains have since been linked to GhostPulse/HijackLoader intrusions, including activity distributed via the ClickFix abuse reported on X.​

Evasion and configuration design

SnappyClient implements multiple evasion layers to resist detection and maintain persistence on infected endpoints.

It hooks LoadLibraryExW to detect when amsi.dll is loaded, then patches AmsiScanBuffer and AmsiScanString always to return AMSI_RESULT_CLEAN, effectively disabling script-content scanning by the Antimalware Scan Interface.

For process injection and API abuse, the malware relies on Heaven’s Gate and direct system calls from a 64-bit mapped copy of ntdll, allowing it to bypass user-mode hooks typically placed by EDR solutions.

It also uses transacted hollowing, reusing logic from HijackLoader, to inject a payload into a trusted process and abuse Chromium’s App-Bound Encryption via the IElevator COM interface to recover AES-256 master keys and decrypt protected browser data.​

The implant ships with an embedded plaintext JSON configuration that defines its identity, file layout, and execution controls, including a malware tag, build ID, default working directory, filenames for encrypted databases, mutex name, and optional persistence settings via scheduled tasks or autorun registry keys.

It can enforce single-instance execution using a shared-memory object whose name is derived from the computer and user name, and it supports a “banned device” mechanism: if a specific hash-based marker file decrypts to “TRUE”, the malware terminates and avoids that host.

Beyond the embedded config, the C2 pushes two additional encrypted configuration files EventsDB and SoftwareDB using ChaCha20-encrypted multi-stream containers with custom headers, which define conditional actions and software targets for theft, respectively.​

SnappyClient uses a custom TCP protocol with full ChaCha20-Poly1305 protection for both control and data channels.

After connecting, the C2 sends an initial packet containing a symmetric key, nonce, and control-session ID; the client proves knowledge of this key and then exchanges compressed JSON messages whose headers and bodies are both encrypted, with Snappy compression and a small framing header indicating size and tag handling.

A separate, heavily obfuscated decryption routine combining Snappy, ChaCha20-Poly1305, SHA-1, SHA-256, a modified RIPEMD-160, Base58, and in-memory 7-Zip extraction is used to recover the list of C2 IPs and the ports used for control (p) and data (dp) sessions.​

Once registered, SnappyClient sends a rich victim profile to the C2, including hostname, username, OS version, uptime, last input time, RAM and CPU details, malware version, ports, system ID, installed AV products, monitor layout, and hashes summarizing the current EventsDB and SoftwareDB contents.

The C2 can then issue a wide range of commands covering screenshot capture, process enumeration and control, file browsing and archiving, keylogger exfiltration, stealing passwords and cookies from Chromium and Mozilla browsers, cloning full browser profiles, targeting extensions and crypto wallets, pulling arbitrary application data using regex filters, executing binaries or DLLs (with optional CMSTPLUA-based UAC bypass), spawning hidden VNC sessions, remote shells, and setting up reverse FTP, VNC, RLOGIN, or SOCKS5 proxies.

SnappyClient’s API structure closely matches HijackLoader’s, with an almost one-to-one mapping. It also includes placeholder (empty) DWORD values for APIs that SnappyClient does not use.

Additional commands synchronize configuration updates, perform clipboard manipulation and search tasks, manage data sessions, and even create on-screen message boxes or embedded browser windows, giving operators fine-grained remote control.​

Post-infection goals and threat outlook

By decrypting SnappyClient traffic and configurations, ThreatLabz concluded that the operators are primarily financially motivated, with a strong focus on cryptocurrency theft.

EventsDB entries instruct the malware to trigger screenshots when clipboard contents match Ethereum wallet regexes or when window titles reference popular crypto platforms like Binance, Coinbase, Exodus, Atomic Wallet, and others, providing high-value intelligence on victims’ crypto activity.

SoftwareDB targets a broad set of Chromium and Firefox-based browsers, crypto browser extensions, and dedicated wallet or crypto-management applications such as Metamask, Phantom, Atomic, Electrum, Ledger Live, and Trezor Suite, enabling credential theft, cookie stealing, and full profile exfiltration across a victim’s cryptocurrency ecosystem.

Code-level overlaps shared API structures, syscall-mapping logic, and transacted-hollowing implementations combined with HijackLoader’s exclusive use as a delivery vector suggest a likely relationship between the developers of HijackLoader and this new SnappyClient C2 framework.​

Given this level of modularity, stealth, and crypto-focused targeting, organizations should treat SnappyClient as an advanced e-crime platform and tighten defenses around loader detection, AMSI integrity, process injection behavior, and anomalous browser and clipboard activity tied to cryptocurrency workflows.

IOCs

SHA256	Description
61e103db36ebb57770443d9249b5024ee0ae4c54d17fe10c1d44e87e2fc5ee99	SnappyClient v0.1.11
23e2a0c25c95eebe1a593b27ac1b81a73b23ddad7617b3b11c69a89c3d49812e	SnappyClient v0.1.9
00019221fb0b61b769d4168664f11c1258e4d61659bd3ffecb126eaf92dbfe2f	SnappyClient v0.1.8
6e360fca0b1e3021908f8de271d80620d634600955fefc9fd0af40557cd517d7	SnappyClient v0.1.7
64a2609d6707a2ebfe5b40f5227d0f9b85911b752cd04f830d1bbc8aa6bec2c8	SnappyClient v0.1.5

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.