The threat intelligence community often reserves its highest scrutiny for targeted, nation-state espionage campaigns. However, commoditized malware operates quietly in the background and is rapidly closing the sophistication gap.
A prime example is the newly discovered OnionDrop loader, which employs an evasion architecture that rivals that of purpose-built targeted tooling.
The Howler Cell Threat Research Team recently identified this loader, tracking more than 645 unique dynamic link library samples between February and May of 2026.
This sustained delivery campaign highlights a payload-agnostic framework engineered to distribute infostealers at scale.
Unlike opportunistic malware, OnionDrop relies on highly disciplined evasion tactics to defeat both static and dynamic analysis.
The threat remains highly active today, dropping dangerous payloads without any constraints on whom it targets.
OnionDrop Loader Evades Detection
The attack chain begins with a simple ZIP archive containing a legitimate, Adobe-signed executable and a massive decoy file designed to inflate the archive size artificially.
When a victim runs the setup file, it sideloads a malicious dependency named sqlite.dll, which dynamically loads the primary codecstore384d.dll module.
From there, the loader initiates a complex, four-stage unpacking sequence to keep security tools entirely in the dark.
To hide its intent, the malware heavily relies on stack-string construction and dynamic application programming interface resolution.
It dynamically decrypts critical functions at runtime and routes all subsequent resolutions through specific native calls to bypass traditional monitoring hooks.
Before advancing, OnionDrop checks the system display device name to filter out sandboxes and virtual environments.
Once the environment is verified, the first unpacking layer uses a custom byte-pair encoding (BPE) routine to reconstruct the encoded data hidden within the file.
The second stage uses native Windows compression tools to decompress this reconstructed data using the Xpress Huffman algorithm.
Following decompression, the malware shifts to a third stage that relies on advanced decryption using incrementally assembled, rotating key material to reveal the payload.
In the final stage, OnionDrop abuses the Windows Thread Pool to execute its embedded Donut shellcode without triggering standard telemetry.
It allocates memory, copies the shellcode, and registers it as a work item. The shellcode then runs dynamically to unpack the final malicious executable directly in memory.
OnionDrop is fundamentally designed to act as an adaptable delivery mechanism rather than a standalone attack. Because it is payload-agnostic, threat operators can easily swap out the final malware depending on their current campaign goals.
The most frequent final payload observed in this operation is LegionLoader, which establishes a connection to a command-and-control server hosted at gainmsg[.]com, cyderes said.
The research team previously tracked this exact threat actor through an earlier campaign that used the Direct-sys Loader.
In more recent attacks, the OnionDrop chain actually hands off execution to the Direct-sys Loader before finally deploying Vidar Stealer.
This creates an exhaustive five-stage delivery pipeline before the actual infostealer ever runs on the infected host.
This evolution demonstrates a sustained engineering investment by the threat actors behind OnionDrop. They are running high-tempo operations that serve multiple infostealer campaigns simultaneously without slowing down.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
