SnappyClient is a full-featured, C++-written remote access trojan and command-and-control (C2) framework that Zscaler ThreatLabz first documented in December 2025, with independent corroboration from GBHackers and a deep three-part investigation ('Operation Turb00') published by CTI researcher Gianluca Tiepolo, culminating in Part 3 (2026-07-02) which reverse-engineers the implant end-to-end.

Delivery occurs via a dedicated, parallel HijackLoader (aka IDAT Loader / GHOSTPULSE / SHADOWLADDER) infection chain distinct from the chain used to deliver Vidar v2.1 in the earlier parts of the same campaign. The loader hides SnappyClient inside a fake Microsoft-branded DLL and process-hollows the payload into a legitimately signed Qihoo 360 binary to inherit trust and evade signature-based defenses. SnappyClient's own C2 configuration is buried behind six stacked layers of compression and encryption, requiring the researcher to peel back each layer to recover the C2 infrastructure. Initial infection vectors observed in the broader campaign include phishing pages impersonating a German telecommunications brand (Telefónica O2) and ClickFix-style fake-CAPTCHA/fake-fix social engineering that chains into GhostPulse/HijackLoader before SnappyClient injection.

Once running, SnappyClient installs a trampoline hook on LoadLibraryExW to detect when amsi.dll is loaded, then patches AmsiScanBuffer and AmsiScanString to always return AMSI_RESULT_CLEAN, neutralizing AMSI-based detection. It uses the Heaven's Gate technique together with direct x64 system calls (issued from a freshly mapped copy of ntdll) to bypass user-mode API hooking employed by EDR/AV products — a methodology that closely mirrors HijackLoader's own implementation, down to an almost one-to-one API structure layout, suggesting shared developers between the two tool families. Process injection is performed via transacted hollowing, the same technique borrowed from HijackLoader, which SnappyClient additionally weaponizes to defeat Chromium's App-Bound Encryption: by injecting into a trusted process and abusing the browser's IElevator COM interface, it recovers the AES-256 master key used to protect saved passwords and cookies.

Operationally, SnappyClient supports screenshot capture (monitor-specific, JPEG), keystroke logging with file-based exfiltration, clipboard monitoring, full remote shell access, process enumeration/suspend/resume/termination, recursive file browsing/archiving/copy/delete, and reverse-proxy tunneling for VNC, FTP, RLOGIN, and SOCKS5. Persistence is optional and implemented via scheduled tasks or HKCU/HKLM Run-key registry entries, and the implant enforces single-instance execution through named shared-memory objects with a 'banned device' hash-marker mechanism, alongside UAC bypass via the CMSTPLUA COM interface.

The implant's cryptocurrency focus is extensive and config-driven. Its embedded EventsDB (JSON, regex/wildcard-based) fires screenshot and clipboard-exfiltration actions when clipboard content matches an Ethereum address pattern (^0x[a-fA-F0-9]{40}$) or when a foreground window title references Binance, Coinbase, Exodus, or Atomic Wallet. Its SoftwareDB targets browser extensions for Coinbase Wallet, MetaMask, Phantom, TronLink, and TrustWallet, and standalone desktop wallet applications including Atomic, Bitcoin Core, Coinomi, Electrum, Exodus, Ledger Live, Trezor Suite, and Wasabi Wallet, alongside generic Chromium/Firefox browser-profile cloning (History, Preferences, Bookmarks, Local/Session Storage, Extensions).

Network communications use a custom TCP protocol authenticated and encrypted end-to-end with ChaCha20-Poly1305. The initial handshake exchanges a 32-byte ChaCha20 key and 12-byte nonce; subsequent messages are Snappy-compressed before encryption and framed with a header containing a command_ID (WORD), message_id (DWORD), and message_length (DWORD). The implant maintains a single control session (command dispatch) plus multiple parallel data sessions used for file transfer. Confirmed C2 endpoints from the Zscaler analysis are 151.242.122.227 (ports 3333/control, 3334/data) and 179.43.167.210 (ports 3333/control, 3334/data). Rich host reconnaissance (hostname, username, OS/CPU/RAM, installed AV, monitor layout, EventsDB/SoftwareDB config hashes) is transmitted to the C2 on check-in.

No CVE applies — SnappyClient is a malware family, not a vulnerability, and no formal threat-actor name has been publicly attributed; researchers link it to the HijackLoader developer ecosystem via code-level and structural overlap, with a financially-motivated, cryptocurrency-theft-centric operational profile.