Hackers Use OnionDrop Loader With DLL Sideloading to Deploy Multiple Infostealers

Gbhackers •Mayura Kathir • June 16, 2026

A professionally engineered loader called OnionDrop is being used in high-tempo campaigns to deliver multiple infostealers at scale. Between February 28 and May 20, 2026, YARA retro-hunting uncovered more than 645 unique OnionDrop DLL samples, and deliveries remained active at the time of publication. The campaign’s operational footprint and evasion techniques place OnionDrop well above […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OnionDrop Loader Campaign Delivers LegionLoader and Infostealers at Scale A new loader campaign, OnionDrop, is actively delivering malicious payloads, including LegionLoader and multiple infostealers, to a wide range of victims. Researchers identified over 645 unique DLL samples associated with OnionDrop between February 28 and May 20, 2026. The campaign employs sophisticated DLL sideloading techniques to evade detection and has been operational since at least early 2026. Current deliveries remain active, indicating a significant ongoing threat to various systems. The scale of the operation and its advanced evasion methods raise serious concerns within the cybersecurity community. 2 sources 68

Extracted Entities

Hackers Use OnionDrop Loader With DLL Sideloading to Deploy Multiple Infostealers

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)