Academy
TermAttack

Infection chain

All the successive steps from the user’s first click to the actual malware running.

Flow

  1. 1Entry
  2. 2Execution
  3. 3Loader
  4. 4Final payload
Related families
Lumma Stealer, Vidar, Remus
MITRE ATT&CK
T1204.004 · User Execution: Malicious Copy and Paste
Sources
7 sources
01

Overview

In current campaigns, malware rarely arrives in a single step. A script downloads a loader, the loader downloads another; each layer makes detection harder and the final payload easier to swap. Palo Alto Networks Unit 42

Knowing the chain makes response easier: it shows at which step it can be broken, which traces remain and which other families arrive through the same chain. Zscaler

02

How it works

  1. 1

    Entry

    Phishing email, malicious ad or fake verification page. CISA and FBI (AA25-141B)

  2. 2

    Execution

    A file the user opens or a command they paste starts a script. MITRE ATT&CK

  3. 3

    Loader

    The script downloads an obfuscated loader; the loader unpacks the actual payload into memory. Palo Alto Networks Unit 42

  4. 4

    Final payload

    An infostealer or remote access trojan runs. Zscaler

03

Real-world examples

Lumma: from a fake CAPTCHA to PowerShell

Lumma Stealer profile

According to CISA and the FBI, the fake CAPTCHA asks the user to open the Run dialog and paste the command in the clipboard; pressing Enter runs a Base64-encoded PowerShell process. CISA and FBI (AA25-141B)

2cLoader: one chain, two families

Remus profile

Zscaler documented that the 2cLoader loader distributed Vidar and Remus together. Zscaler

04

How to detect it

  • Every link of the chain leaves a trace: Run history, script logs, files in temporary folders and short-lived processes. MITRE ATT&CK
05

What to do

  • Break the chain at the earliest link: restrict use of the Run dialog and script interpreters. MITRE ATT&CK
06

MITRE ATT&CK

T1204.004User Execution: Malicious Copy and PasteT1059.001PowerShellT1105Ingress Tool Transfer
07

Related families and terms

Families

Lumma StealerActiveVidarActiveRemusActive

Report

Infostealer Threat Report — October 2026

Terms

Cyber Kill ChainPhishingFileless malware
08

Sources

  1. 1User Execution: Malicious Copy and Paste (T1204.004) · MITRE ATT&CK
  2. 2PowerShell (T1059.001) · MITRE ATT&CK
  3. 3Ingress Tool Transfer (T1105) · MITRE ATT&CK
  4. 4PhantomVAI loader delivers infostealers · Palo Alto Networks Unit 42, 2025
  5. 52cLoader: new malware loader delivering Vidar and Remus · Zscaler
  6. 6Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations · CISA and FBI (AA25-141B), 2025-05-21
  7. 7Behavior Prevention on Endpoint (M1040) · MITRE ATT&CK
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans