Kiss Loader Malware Uses Early Bird APC Injection Attacks

A novel malware loader, dubbed Kiss Loader, has been identified exploiting advanced code injection techniques. This serious threat targets Windows systems, enabling stealthy infiltration and avoiding detection by security measures.

First spotted in early March 2026, it marks the beginning of a carefully built attack campaign that was still actively under development when researchers first caught it.

Kiss Loader spreads through a Windows Internet Shortcut file disguised as a PDF document, named DKM_DE000922.pdf.url.

When a victim clicks it, the system silently connects to a remote server hosted through a TryCloudflare tunnel — a legitimate service that creates temporary internet connections without needing a registered domain.

This use of trusted infrastructure lets the attacker freely update or swap malicious files, making the campaign significantly harder to track and block in time.

G DATA analysts identified Kiss Loader during a routine investigation that turned into something far more unusual.

The malware had not been seen before in the wild, marking it as a newly built tool designed specifically for this campaign.

Analysts noted that the attacker’s WebDAV file hosting directory was completely open with no access restrictions, revealing the threat actor was still actively working on the loader when researchers first encountered it.

Once inside a target system, Kiss Loader begins a layered infection process. A batch script places a persistence file into the Windows Startup folder so the malware runs automatically on every reboot, while a decoy PDF appears on screen to keep the victim unaware.

Additional components download quietly in the background, and the arriving archive contains a Python-based loader that decrypts payloads using keys from JSON configuration files, keeping the malicious code hidden until the final stage.

Two payloads were recovered — VenomRAT, an AsyncRAT-like remote access tool, and a .NET Reactor-protected file identified as Kryptik.

Perhaps the most striking element of this case was the direct exchange between analyst and attacker. During controlled environment analysis, a G DATA researcher left a Notepad message asking if the person on the other end had authored the malware.

About an hour later, the threat actor replied — confirming active presence on the compromised machine and acknowledging that the Early Bird APC injection technique was intentionally built into the loader.

Early Bird APC Injection: How Kiss Loader Evades Detection

The core of Kiss Loader’s evasion strategy is Early Bird APC injection, which delivers its payload inside a legitimate Windows process.

The loader targets explorer.exe, a trusted system process, to blend in with normal activity and avoid triggering security alerts.

Kiss Loader first launches explorer.exe in a suspended state, meaning the process starts but holds before executing any normal tasks. The loader then allocates memory inside the process and writes the decrypted shellcode into it.

Rather than creating a new thread — a method that security tools actively monitor — it queues an Asynchronous Procedure Call to the suspended process’s primary thread instead.

When execution resumes, the APC fires first, running the shellcode before Explorer begins normal operation, all within a trusted process context.

The shellcode was built using Donut, an open-source tool that converts .NET assemblies into memory-only shellcode, leaving nothing written to disk and making traditional antivirus detection far less effective.

The loader also generates detailed runtime output logging each injection step, confirming it was still in a testing phase at the time of discovery.

Users should avoid opening .url files from unverified sources, as this is Kiss Loader’s primary entry point.

Security teams should configure EDR solutions to detect APC-based injection targeting processes like explorer.exe, and monitor outbound connections to TryCloudflare domains for early compromise signals.

Administrators should enforce proper authentication on WebDAV directories to prevent open payload hosting. Keeping Windows and installed software updated reduces exposure to techniques that weaponize built-in system functionality for malicious purposes.

IoCs:-

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.