Reported by 2 outlets
2CLoader: A New Malware Loader Delivering Vidar and Remus
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
Zscaler ThreatLabz documented in August 2026 a new malware loader tracked as 2CLoader, observed distributing the Vidar and Remus information stealers plus the XWorm RAT. The report is a technical deep dive covering the loader configuration, network communication, payload decryption, and payload execution options. Based on observed delivery trends, Vidar and Remus are the primary payloads.
The loader's value to operators is evasion. It uses indirect system calls and inline trampoline hooks on Windows APIs to hide from endpoint tooling, decrypts important strings at runtime through an inlined bitwise XOR operation with key 0x37, and runs anti-VM, anti-debug, and user activity checks before executing. Multiple execution and persistence mechanisms are available and selected by configuration, so individual campaigns can vary their footprint.
What to watch: 2CLoader is new delivery infrastructure for an established stealer economy rather than a novel threat class, so its significance depends on adoption. Defenders can anchor detections on the XOR key 0x37 string decryption, indirect syscall patterns, and the anti-analysis checks described in the report, then map any hits to the Vidar and Remus response playbooks they already run.
Timeline
-
original reporting
2CLoader: A New Malware Loader Delivering Vidar and Remus
malware.news · 13d ago · September 30th, 2026
IntroductionIn August 2026, Zscaler ThreatLabz identified a new loader, which we track as 2CLoader. ThreatLabz has observed the loader being used to distribute information stealers including Vidar and Remus in addition to XWorm RAT. 2CLoader has the ability to perform a wide range of anti-analysis and evasion techniques, including indirect system calls, anti-analysis checks, and installing Windows APIs hooks. In this blog post, ThreatLabz provides a technical deep dive into 2CLoader, covering its core features, evasion techniques, loader configuration, network communication, payload decryption, and execution options. Key TakeawaysIn August 2026, ThreatLabz identified a new loader tracked as 2CLoader.2CLoader implements multiple anti-analysis techniques, including anti-VM, anti-debug, and user activity checks.2CLoader employs several evasion techniques to hinder detection by endpoint security tools, including indirect system calls and inline trampoline hooks.2CLoader supports multiple payload execution and persistence mechanisms, depending on its configuration. Based on observed delivery trends, 2CLoader has primarily been used to deliver Vidar and Remus. Technical AnalysisThe following sections analyze 2CLoader’s core features and cover malware delivery trends associated with the loader.String encryptionImportant strings in 2CLoader are decrypted at runtime using an inlined bitwise XOR operation applied to global values. The key in the analyzed sample is 0x37.Indirect system
-
update from www.zscaler.com
(zscaler.com) 2CLoader: A Sophisticated New Malware Loader Delivering Vidar and Remus Information Stealers In brief - This article describes
www.zscaler.com · 13d ago · September 30th, 2026
(zscaler.com) 2CLoader: A Sophisticated New Malware Loader Delivering Vidar and Remus Information Stealers In brief - This article describes
via Mastodon https://www.zscaler.com/blogs/security-research/2cloader-new-malware-loader-delivering-vidar-and-remus