C2Looper Malware Uses OneDrive DLL Sideloading for Stealthy Updates

Key Takeaways

• C2Looper is a recently identified Windows backdoor enabling stealthy remote control and additional malware deployment.
• It utilizes OneDrive DLL sideloading for covert updates and employs GitHub for command-and-control (C2) in its latest version.
• Initial infection often occurs via “ClickFix” social engineering, tricking users into executing malicious commands.
• Security researchers at Zscaler assess a potential connection between C2Looper and ransomware operations.
• No direct patch is available; mitigation requires vigilance against social engineering, monitoring unusual process behavior, and restricting script execution.

A new backdoor, dubbed C2Looper, has been discovered providing attackers with a surreptitious method for maintaining control over compromised Windows systems. This sophisticated malware facilitates remote command execution, network reconnaissance, and the deployment of further payloads, posing a significant threat, particularly in the context of ransomware campaigns.

Despite its relatively concise set of functionalities, C2Looper offers a persistent foothold within corporate networks. Its initial delivery mechanism is believed to be a multi-stage ClickFix attack chain, where users are manipulated into running commands under the guise of resolving browser or system issues. This technique mirrors other recent ClickFix campaigns that leverage user interaction to establish an initial compromise.

Analysts at Zscaler said in a report, released in July 2026, that C2Looper is still under active development and expansion. The firm assesses, with low to medium confidence, that the malware is linked to a ransomware-affiliated actor and is likely used to establish initial access for subsequent lateral movement. The specific identity of the threat actor behind C2Looper remains unconfirmed, leaving security teams to monitor for potential ransomware precursors across their environments.

C2Looper Updates Itself Through OneDrive DLL Sideloading

An earlier iteration of C2Looper employs a DLL sideloading technique involving Microsoft OneDrive to update itself discreetly. This variant uses an upload command to retrieve a portable executable, which it then saves as a DLL file within the user’s local OneDrive directory. Subsequently, the malware terminates the legitimate OneDrive process, relying on the trusted OneDrive executable to load the maliciously placed library.

DLL sideloading exploits how Windows applications sometimes load necessary libraries from their current working directories. Attackers capitalize on this by strategically placing a malicious file with a name that a legitimate program expects to load. This allows hostile code to execute under the guise of a trusted process, making detection more challenging. Researchers believe this method serves as C2Looper’s update mechanism, enabling operators to refresh or replace the backdoor without drawing undue attention.

This approach underscores the importance for defenders to scrutinize unusual child processes, unexpected DLL files, and abrupt restarts of legitimate applications like OneDrive, rather than solely trusting an executable based on its name. This tactic aligns with a broader trend of attackers co-opting reputable software to mask their malicious activities, as observed in recent instances of signed software abuse where legitimate, digitally signed applications were used to launch malicious components following a ClickFix lure.

GitHub C2 Expands Operator Control

The initial version of C2Looper communicated with its command-and-control server over unencrypted HTTP, sending basic system information such as username, hostname, and process ID, then polling for tasks every second. This early build provided capabilities for remote shell access, command execution, and file downloads, establishing a foundational platform for reconnaissance and lateral movement within a network. A task-ID parsing error present in this older version was addressed in subsequent releases.

A newer variant, internally designated version 2, has shifted all command-and-control (C2) operations to GitHub. Each infected machine is assigned a unique directory within a GitHub repository. Instructions for the malware are stored in a file named cmd.json, command outputs are saved in result.json, and beacon.json records the bot’s identifier and the timestamp of its last successful check-in.

Leveraging a widely used code-hosting platform like GitHub makes it significantly harder for security teams to differentiate malicious traffic from legitimate business-related network activity. This strategy reflects a growing trend of misusing GitHub-based command channels. Security teams should therefore prioritize investigating unfamiliar repositories, unexpected automated access, and sudden outbound connections originating from suspicious processes.

Version 2 also introduces enhanced capabilities, including file listing, expanded host discovery, and a code-injection function. Its reconnaissance module gathers comprehensive details about domains, user accounts, installed software, and drive configurations. This information is invaluable to attackers for mapping critical systems before deploying additional malicious payloads or ransomware.

Further refinements in the revised variant include an upload command that retrieves files from a dedicated repository folder directly into the Windows temporary directory. The run command now executes a file and promptly deletes it upon successful completion. Moreover, command output is now captured via Windows pipes, eliminating the older method of using local output files and thereby reducing a detectable artifact. These improvements indicate that the developers are actively refining C2Looper in response to operational weaknesses, making it a more elusive threat.

What You Should Do

• Educate users about social engineering tactics, especially “ClickFix” lures that prompt them to execute commands or download files to resolve perceived system issues.
• Implement strong endpoint detection and response (EDR) solutions capable of monitoring for unusual child processes, unexpected DLL loads, and abnormal application behavior, particularly involving legitimate software like OneDrive.
• Restrict script execution capabilities for non-administrative users and enforce application whitelisting to prevent unauthorized executables from running.
• Monitor network traffic for suspicious outbound connections to unfamiliar GitHub repositories or other non-sanctioned C2 infrastructure.
• Regularly review system logs and security alerts for indications of compromise, including sudden OneDrive restarts or unexpected file modifications in user directories.
• Maintain up-to-date threat intelligence on emerging malware and attack vectors, leveraging indicators of compromise (IoCs) in security tools to detect and block C2Looper activity.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.