SnappyClient C2 Framework — New Implant Delivered via HijackLoader and ClickFix — Threadlinqs Intelligence
As of 2026-05-30, SnappyClient C2 Framework — New Implant Delivered via HijackLoader and ClickFix is a critical-severity malware threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-0246 · Severity: CRITICAL · Status: ACTIVE · Category: MALWARE
Attribution: N/A · FINANCIAL
SnappyClient is a sophisticated C++-based command-and-control framework implant first observed in December 2025, actively delivered via HijackLoader and ClickFix social engineering campaigns as of
SnappyClient is a newly identified C++ command-and-control (C2) framework implant discovered by Zscaler ThreatLabz during incident response investigations. The malware has been tracked across five versions (0.1.5 through 0.1.11) and demonstrates rapid iterative development by its operators.
## Delivery Chains
SnappyClient is exclusively delivered through HijackLoader (also known as IDAT Loader), with two confirmed delivery vectors:
1. **HijackLoader via Phishing Sites (December 2025):** Threat actors created phishing sites impersonating legitimate companies such as Telefonica O2, specifically targeting German-speaking users. Victims download HijackLoader executables that decrypt and deploy the SnappyClient payload.
2. **ClickFix/GhostPulse Social Engineering (February 2026):** A secondary delivery mechanism documented via security researcher @Kostastsale on X, where ClickFix social engineering tricks users into executing commands that ultimately load HijackLoader, which then delivers SnappyClient.
Code-level similarities between HijackLoader and SnappyClient — including matching API structure layouts, identical direct-syscall population routines, and parallel transacted-hollowing implementations — strongly suggest shared developer ownership.
## Implant Architecture
SnappyClient operates on a dual-session TCP architecture:
- **Control Session (port 3333):** Single persistent connection for registration, heartbeats, and command receipt
- **Data Sessions (port 3334):** Multiple concurrent connections for file transfers, credential exfiltration, and bulk data upload
All communications are encrypted with ChaCha20-Poly1305 and compressed using the Snappy compression algorithm (from which the malware derives its name). The protocol uses a structured message header with command IDs (2 bytes), Mersenne Twister-generated message IDs (4 bytes), and plaintext length indicators.
## Evasion Capabilities
SnappyClient employs multiple defense evasion techniques:
- **AMSI Bypass:** Hooks LoadLibraryExW to intercept amsi.dll loading, then patches AmsiScanBuffer and AmsiScanString to always return AMSI_RESULT_CLEAN
- **Heaven's Gate:** 32-bit to 64-bit execution context transitions for direct system calls, bypassing userland API hooks
- **Transacted Hollowing:** Advanced process injection technique combining transacted sections with process doppelganging and DLL hollowing
- **App-Bound Encryption Bypass:** Uses transacted hollowing to inject into trusted browser processes and retrieve AES-256 master keys for Chrome cookie/credential decryption
## Configuration System
The implant uses three encrypted configuration databases:
- **Main Config (JSON-embedded):** Contains build ID, installation directory, persistence settings, mutex name, and version enforcement via shared memory
- **EventsDB (ChaCha20 encrypted, magic 0xCEDD9AB7):** Conditional action triggers based on clipboard regex patterns and window titles — actions include clipboard replacement, screenshot capture, and HTTP-based clipboard exfiltration
- **SoftwareDB (ChaCha20 encrypted, magic 0x7FCBB9E9):** Target application definitions for data theft operations
Network configuration decryption involves a multi-stage pipeline: ChaCha20-Poly1305, SHA1/SHA256, modified RIPEMD-160, Snappy decompression, Base58 decoding, and embedded 7-Zip archive extraction.
## Data Theft Capabilities
SnappyClient targets an extensive range of applications:
- **Browsers (10+):** Chrome, Firefox, Edge, Brave, Opera, and others — extracting passwords, cookies, browsing history, and extension data
- **Cryptocurrency Wallet Extensions (5):** Coinbase Wallet, MetaMask, Phantom, TronLink, TrustWallet
- **Cryptocurrency Desktop Applications (8):** Atomic Wallet, Bitcoin Core, Coinomi, Electrum, Exodus, Ledger Live, Trezor Suite, Wasabi Wallet
- **Clipboard Monitoring:** Real-time Ethereum address detection (regex: ^0x[a-fA-F0-9]{40}$) for clipboard replacement attacks
## Command Set
The C2 protocol su
Target sectors: financial, cryptocurrency, retail, telecommunications, technology
Target regions: Europe, Germany, North America, Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, CRITICAL, threat intelligence, cybersecurity, T1566, T1204, T1059, T1053, T1547, T1562, T1055, T1140, T1027, T1555