# SnappyClient C2 Framework — New Implant Delivered via HijackLoader and ClickFix

> SnappyClient is a sophisticated C++-based command-and-control framework implant first observed in December 2025, actively delivered via HijackLoader and ClickFix social engineering campaigns as of February 2026. The implant provides comprehensive remote access, credential theft, keylogging, screenshot capture, hidden VNC/proxy capabilities, and cryptocurrency wallet exfiltration targeting Windows systems.

- **Published:** 2026-03-18T12:00:00Z
- **Last reviewed:** 2026-03-18T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0246
- **ID:** TL-2026-0246
- **Severity:** CRITICAL
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SnappyClient is a newly identified C++ command-and-control (C2) framework implant discovered by Zscaler ThreatLabz during incident response investigations. The malware has been tracked across five versions (0.1.5 through 0.1.11) and demonstrates rapid iterative development by its operators.

## Delivery Chains

SnappyClient is exclusively delivered through HijackLoader (also known as IDAT Loader), with two confirmed delivery vectors:

1. **HijackLoader via Phishing Sites (December 2025):** Threat actors created phishing sites impersonating legitimate companies such as Telefonica O2, specifically targeting German-speaking users. Victims download HijackLoader executables that decrypt and deploy the SnappyClient payload.

2. **ClickFix/GhostPulse Social Engineering (February 2026):** A secondary delivery mechanism documented via security researcher @Kostastsale on X, where ClickFix social engineering tricks users into executing commands that ultimately load HijackLoader, which then delivers SnappyClient.

Code-level similarities between HijackLoader and SnappyClient — including matching API structure layouts, identical direct-syscall population routines, and parallel transacted-hollowing implementations — strongly suggest shared developer ownership.

## Implant Architecture

SnappyClient operates on a dual-session TCP architecture:
- **Control Session (port 3333):** Single persistent connection for registration, heartbeats, and command receipt
- **Data Sessions (port 3334):** Multiple concurrent connections for file transfers, credential exfiltration, and bulk data upload

All communications are encrypted with ChaCha20-Poly1305 and compressed using the Snappy compression algorithm (from which the malware derives its name). The protocol uses a structured message header with command IDs (2 bytes), Mersenne Twister-generated message IDs (4 bytes), and plaintext length indicators.

## Evasion Capabilities

SnappyClient employs multiple defense evasion techniques:
- **AMSI Bypass:** Hooks LoadLibraryExW to intercept amsi.dll loading, then patches AmsiScanBuffer and AmsiScanString to always return AMSI_RESULT_CLEAN
- **Heaven's Gate:** 32-bit to 64-bit execution context transitions for direct system calls, bypassing userland API hooks
- **Transacted Hollowing:** Advanced process injection technique combining transacted sections with process doppelganging and DLL hollowing
- **App-Bound Encryption Bypass:** Uses transacted hollowing to inject into trusted browser processes and retrieve AES-256 master keys for Chrome cookie/credential decryption

## Configuration System

The implant uses three encrypted configuration databases:
- **Main Config (JSON-embedded):** Contains build ID, installation directory, persistence settings, mutex name, and version enforcement via shared memory
- **EventsDB (ChaCha20 encrypted, magic 0xCEDD9AB7):** Conditional action triggers based on clipboard regex patterns and window titles — actions include clipboard replacement, screenshot capture, and HTTP-based clipboard exfiltration
- **SoftwareDB (ChaCha20 encrypted, magic 0x7FCBB9E9):** Target application definitions for data theft operations

Network configuration decryption involves a multi-stage pipeline: ChaCha20-Poly1305, SHA1/SHA256, modified RIPEMD-160, Snappy decompression, Base58 decoding, and embedded 7-Zip archive extraction.

## Data Theft Capabilities

SnappyClient targets an extensive range of applications:
- **Browsers (10+):** Chrome, Firefox, Edge, Brave, Opera, and others — extracting passwords, cookies, browsing history, and extension data
- **Cryptocurrency Wallet Extensions (5):** Coinbase Wallet, MetaMask, Phantom, TronLink, TrustWallet
- **Cryptocurrency Desktop Applications (8):** Atomic Wallet, Bitcoin Core, Coinomi, Electrum, Exodus, Ledger Live, Trezor Suite, Wasabi Wallet
- **Clipboard Monitoring:** Real-time Ethereum address detection (regex: ^0x[a-fA-F0-9]{40}$) for clipboard replacement attacks

## Command Set

The C2 protocol supports a rich command set identified by hex command IDs:
- 0xFFFF: Registration with victim metadata (volume serial, CPU signature, computer/user name)
- 0xCCCE: Screenshots, process management, file operations, keylogger exfiltration, browser credential theft, VNC browser, remote file browser, remote shell
- 0xCCCC: Reverse proxy setup (FTP/VNC/RLOGIN/SOCKS5)
- 0xDDDD: Data session lifecycle control
- 0xDCCA: File/folder transmission, keylogger upload
- 0xDACC: Multi-browser credential stealing, file download, file search
- 0xDADA: Download job management
- 0xEECC: EventsDB/SoftwareDB synchronization
- 0xACCC: Exit and device ban (SHA-1 hash of VolumeSerialNumber:BANNED)
- 0xADBB: MessageBox/IWebBrowser window creation, network config updates

## Persistence

SnappyClient establishes persistence through two mechanisms:
1. Scheduled task creation with a logon trigger
2. Registry Run key installation at HKCU\Software\Microsoft\Windows\CurrentVersion\Run

The implant self-replicates to a configured installation directory and uses a named shared memory object (FNV-1a hash of reversed COMPUTERNAME+USERNAME XOR length) for version enforcement across instances.

## System Fingerprinting

Victim identification is computed from: volume serial number + CPU signature (CPUID EAX=1) + computer name + username, creating a unique device identifier used for C2 session management and device banning.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1547 Boot or Logon Autostart Execution
- T1685 Disable or Modify Tools
- T1055 Process Injection
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1056 Input Capture
- T1010 Application Window Discovery
- T1057 Process Discovery
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1113 Screen Capture
- T1115 Clipboard Data
- T1005 Data from Local System
- T1074 Data Staged
- T1573 Encrypted Channel
- T1571 Non-Standard Port
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel

## Sources

- [Zscaler ThreatLabz: Technical Analysis of SnappyClient](https://www.zscaler.com/blogs/security-research/technical-analysis-snappyclient)
- [ThreatLabz GitHub — SnappyClient Decryption Tools](https://github.com/ThreatLabz/tools)
- [CrowdStrike: HijackLoader Expands Techniques to Improve Defense Evasion](https://www.crowdstrike.com/en-us/blog/hijackloader-expands-techniques/)
- [Seqrite: Deconstructing ClickFix HijackLoader Phishing Campaign](https://www.seqrite.com/blog/deconstructing-a-cyber-deception-an-analysis-of-the-clickfix-hijackloader-phishing-campaign/)
- [The Hacker News: Hijack Loader Malware Employs Process Hollowing and UAC Bypass](https://thehackernews.com/2024/05/hijack-loader-malware-employs-process.html)
- [ANY.RUN: New HijackLoader Process Hollowing and Anti-Evasion](https://any.run/cybersecurity-blog/new-hijackloader-version/)
- [r-tec: Bypass AMSI in 2025](https://www.r-tec.net/r-tec-blog-bypass-amsi-in-2025.html)
- [Elastic Security Labs: From ClickFix Deception to Information Stealer Deployment](https://www.elastic.co/security-labs/a-wretch-client)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0246