Latrodectus malware: what this Windows loader is, is it a virus, and how to remove it

Do it yourself · free Remove Latrodectus (Windows loader, also called IceNova and BlackWidow) yourself 5 steps, 15 minutes, no software needed.

Latrodectus (Windows loader, also called IceNova and BlackWidow): summary

Facts checked on 25 October 2026 against the abuse.ch ThreatFox data held in our radar, Elastic Security Labs, MITRE ATT&CK S1160 and Malpedia.

We did not run a sample, did not visit any address and infected no PC; the removal steps follow Windows' own menus and general recovery practice, and were not tried on a live infection. Report titles that we know only from Malpedia's list are marked as such.

What Latrodectus is, and what we know it

Latrodectus is not a website and not a program you install on purpose. It is a loader: a small backdoor whose main job is to get onto a Windows PC, report to a controlling server, and download and run more malware. The name is the Latin name of the widow spider genus, which is why some vendors also call it BlackWidow. Other names in use are IceNova and Lotus.

1 What it is MITRE ATT&CK describes it as a Windows downloader in use since at least 2023 that fetches and runs further payloads and modules, mostly spread through email campaigns. Malpedia calls it a backdoor written in C that talks to its server over HTTP with RC4 encrypted requests. Both agree on the core: it opens the door, others walk through.

MITRE ATT&CK describes it as a Windows downloader in use since at least 2023 that fetches and runs further payloads and modules, mostly spread through email campaigns. Malpedia calls it a backdoor written in C that talks to its server over HTTP with RC4 encrypted requests. Both agree on the core: it opens the door, others walk through.

2 Where it came from Elastic Security Labs says it was discovered in October 2023 by researchers at Walmart, who were looking at an IcedID loader. Malpedia and Elastic both tie it to the IcedID family: Malpedia says it is believed to be developed by LUNAR SPIDER, the group behind IcedID (also called BokBot). Elastic wrote in May 2024 that it looked like a possible IcedID replacement.

Elastic Security Labs says it was discovered in October 2023 by researchers at Walmart, who were looking at an IcedID loader. Malpedia and Elastic both tie it to the IcedID family: Malpedia says it is believed to be developed by LUNAR SPIDER, the group behind IcedID (also called BokBot). Elastic wrote in May 2024 that it looked like a possible IcedID replacement.

3 Who uses it MITRE lists two email crime groups that use it, TA577 and TA578. Malpedia also links the actor Storm-0249 through a Microsoft Threat Intelligence report on tax themed phishing from April 2025. A loader is sold or shared as a service, so the person who infects you is often not the person who wrote it.

MITRE lists two email crime groups that use it, TA577 and TA578. Malpedia also links the actor Storm-0249 through a Microsoft Threat Intelligence report on tax themed phishing from April 2025. A loader is sold or shared as a service, so the person who infects you is often not the person who wrote it.

4 What the radar showed Our topic radar picked the name up from abuse.ch ThreatFox, which holds 12 entries for the malware name Latrodectus. The latest is from 21 October 2026, and there are entries on 18, 19 and 20 October as well. ThreatFox lists indicators such as server addresses; we did not copy any of them into this page, apart from older, published domain names from Elastic's report.

What the radar showed

Our topic radar picked the name up from abuse.ch ThreatFox, which holds 12 entries for the malware name Latrodectus. The latest is from 21 October 2026, and there are entries on 18, 19 and 20 October as well. ThreatFox lists indicators such as server addresses; we did not copy any of them into this page, apart from older, published domain names from Elastic's report.

5 What we could not confirm We did not run a sample and we did not infect a PC. We found no Microsoft Defender detection name for it in the pages we read, so none is printed here. We also cannot say which delivery method the October 2026 ThreatFox entries belong to. Everything below behaviour comes from the vendor and MITRE pages named in the sources.

What we could not confirm

We did not run a sample and we did not infect a PC. We found no Microsoft Defender detection name for it in the pages we read, so none is printed here. We also cannot say which delivery method the October 2026 ThreatFox entries belong to. Everything below behaviour comes from the vendor and MITRE pages named in the sources.

What Latrodectus (Windows loader, also called IceNova and BlackWidow) does on an infected PC

What we checked on 25 October 2026, and what we could not

This page is a malware family, not one web address, so there was no site to open and no screenshot to take. Our check was a lookup of the radar data we hold, plus the pages in the sources. Our tool did not send a request anywhere, because the subject is a name and not a plain domain.

Our check, 25 October 2026

ThreatFox listing 12 entries under the malware name Latrodectus; the newest on 21 October 2026. The family is still active in the data we hold.

Site test Not done. There is no single address to test, and the plain request from our server was marked not requested for a name.

URLhaus reports None in our copy of the data for this subject. That says nothing safety: loaders like this are often delivered by email, not by a file link that URLhaus sees.

Registration data No domain record applies, so no registration date is available.

Files and samples We did not download or run any sample. We cannot tell you which build is current.

Dangerous: a real, active loader family The rating comes from the vendor and MITRE descriptions and from the fresh ThreatFox entries, not from a site visit. A quiet look at one log or one scan never clears a PC of a loader.

Latrodectus from the first sample to today

The family is three years old and has stayed in use. The dates below come from Elastic, MITRE, Malpedia and the ThreatFox data we hold.

October 2023 First seen Walmart Global Tech publishes an analysis of an IcedID loader on 20 October 2023, the work Elastic credits with the discovery. IBM X-Force and eSentire follow in December 2023, the latter describing DanaBot deploying it.

Walmart Global Tech publishes an analysis of an IcedID loader on 20 October 2023, the work Elastic credits with the discovery. IBM X-Force and eSentire follow in December 2023, the latter describing DanaBot deploying it.

March 2024 Email campaigns start Elastic says email campaigns delivering Latrodectus were seen from early March 2024. Proofpoint and Team Cymru publish on 4 April 2024 the similarities with IcedID.

Email campaigns start

Elastic says email campaigns delivering Latrodectus were seen from early March 2024. Proofpoint and Team Cymru publish on 4 April 2024 the similarities with IcedID.

16 May 2024 Elastic publishes a full analysis Elastic Security Labs describes version 1.1 of the beacon, its checks against analysis machines, its command handlers and its link to IcedID. New handlers had been added since the first reports, which means the code was still being developed.

Elastic publishes a full analysis

Elastic Security Labs describes version 1.1 of the beacon, its checks against analysis machines, its command handlers and its link to IcedID. New handlers had been added since the first reports, which means the code was still being developed.

2024 to 2025 Many campaigns, new delivery tricks Malpedia lists reports from Netskope and Hunt.io (August 2024), EclecticIQ (October 2024) on ransomware in the financial sector, and a delivery route through the Telegram bot interface (April 2025). In April 2025 Microsoft describes tax themed phishing that Malpedia ties to Storm-0249.

Many campaigns, new delivery tricks

Malpedia lists reports from Netskope and Hunt.io (August 2024), EclecticIQ (October 2024) on ransomware in the financial sector, and a delivery route through the Telegram bot interface (April 2025). In April 2025 Microsoft describes tax themed phishing that Malpedia ties to Storm-0249.

September to December 2025 Intrusions and a remote control add on The DFIR Report publishes an intrusion enabled by LUNAR SPIDER on 29 September 2025. Netresec describes a BackConnect feature on 10 December 2025. We read only the titles of these, not the pages.

September to December 2025

Intrusions and a remote control add on

The DFIR Report publishes an intrusion enabled by LUNAR SPIDER on 29 September 2025. Netresec describes a BackConnect feature on 10 December 2025. We read only the titles of these, not the pages.

February 2026 A ClickFix campaign that ended in encryption Malpedia lists a CERT.PL report of 17 February 2026 a ClickFix campaign in which a company's data was encrypted. We did not read it, so we cannot say whether Latrodectus was the only tool used.

A ClickFix campaign that ended in encryption

Malpedia lists a CERT.PL report of 17 February 2026 a ClickFix campaign in which a company's data was encrypted. We did not read it, so we cannot say whether Latrodectus was the only tool used.

18 to 21 October 2026 Fresh ThreatFox entries ThreatFox holds entries for the name on 18, 19, 20 and 21 October 2026, 12 in total. This is the reason for this page and shows the family is not retired.

18 to 21 October 2026

Fresh ThreatFox entries

ThreatFox holds entries for the name on 18, 19, 20 and 21 October 2026, 12 in total. This is the reason for this page and shows the family is not retired.

How an infection with Latrodectus usually runs

The steps below are the order in which vendors describe the family working. Not every campaign uses every step, and we did not see the October 2026 samples ourselves.

1 A lure reaches you MITRE lists spearphishing attachments and links as the way in, and it names user execution of a malicious file or link. The results we saw mention fake copyright notices and JavaScript files. Malpedia's list adds tax themed mail and a ClickFix campaign, where a page tells you to paste a command into Windows yourself.

MITRE lists spearphishing attachments and links as the way in, and it names user execution of a malicious file or link. The results we saw mention fake copyright notices and JavaScript files. Malpedia's list adds tax themed mail and a ClickFix campaign, where a page tells you to paste a command into Windows yourself.

2 A script or installer runs MITRE names JavaScript, the Windows command shell, WMI, msiexec and rundll32 among the tools it uses. These are normal Windows parts, so the first run often looks harmless. Elastic's sample was a packed DLL that pretended to be a Bitdefender driver file named TRUFOS.SYS.

A script or installer runs

MITRE names JavaScript, the Windows command shell, WMI, msiexec and rundll32 among the tools it uses. These are normal Windows parts, so the first run often looks harmless. Elastic's sample was a packed DLL that pretended to be a Bitdefender driver file named TRUFOS.SYS.

3 The loader checks where it is Elastic found that it exits if a debugger is attached, if the machine runs fewer than 75 processes on a recent Windows, if it runs as a 32 bit program, or if there is no valid network card address. These checks are aimed at the test machines of security firms and also mean a very quiet virtual machine may not show it.

The loader checks where it is

Elastic found that it exits if a debugger is attached, if the machine runs fewer than 75 processes on a recent Windows, if it runs as a 32 bit program, or if there is no valid network card address. These checks are aimed at the test machines of security firms and also mean a very quiet virtual machine may not show it.

4 It settles in and calls It copies itself to a folder in your profile, sets a scheduled task so it starts at sign in, and sends an encrypted registration to its server. The registration includes the Windows version, user name, computer name, domain and a hardware based identifier, which tells the operator whether you are a PC or a company machine.

It settles in and calls

It copies itself to a folder in your profile, sets a scheduled task so it starts at sign in, and sends an encrypted registration to its server. The registration includes the Windows version, user name, computer name, domain and a hardware based identifier, which tells the operator whether you are a PC or a company machine.

5 The malware arrives The server answers with commands. The loader can download and run an EXE, a DLL or shellcode, or fetch IcedID. What comes depends on the buyer: Elastic and EclecticIQ's report titles show IcedID and ransomware activity in the same circles, and MITRE lists VNC remote control among its techniques.

The malware arrives

The server answers with commands. The loader can download and run an EXE, a DLL or shellcode, or fetch IcedID. What comes depends on the buyer: Elastic and EclecticIQ's report titles show IcedID and ransomware activity in the same circles, and MITRE lists VNC remote control among its techniques.

What Latrodectus can do on a PC

Elastic's 2024 analysis of version 1.1 lists the command handlers below by number. They show the shape of the tool: look around, send the picture to the server, download more, update and hide.

MITRE adds the wider picture: discovery of accounts, domain trusts, network shares, running processes and security software, collection of data from the local system, exfiltration over the same channel, and a system shutdown or reboot. Which of these the operator really uses is decided case by case, so treat the list as what is possible, not what happens to every victim.

It hides its own traces too. Elastic describes self deletion through an NTFS alternate data stream, strings that are obfuscated, and system functions looked up by a CRC32 hash at run time so that a static scan sees fewer clues. MITRE records the same ideas as indicator removal, packing and dynamic API resolution.

What Latrodectus (Windows loader, also called IceNova and BlackWidow) can steal or download

What a loader puts at risk

Latrodectus itself is a delivery tool, so the real damage is what it fetches. The list below mixes what the sources say the loader collects with what the follow up malware in these campaigns is known to take.

Your Windows version, user and computer name

Domain and network details

Names of files on the desktop

Security software installed

Extra malware such as IcedID

Remote control through VNC

Data from the local system

Ransomware in later stages

High A second, worse infection The loader exists to bring other malware. EclecticIQ's report title and the CERT.PL entry in Malpedia link the family to ransomware activity. What arrives is the buyer's choice.

A second, worse infection

The loader exists to bring other malware. EclecticIQ's report title and the CERT.PL entry in Malpedia link the family to ransomware activity. What arrives is the buyer's choice.

High Company networks The loader reports the domain and collects domain trust and information, which is what an intruder needs to move on from one work PC to the rest.

The loader reports the domain and collects domain trust and information, which is what an intruder needs to move on from one work PC to the rest.

High Passwords and accounts We found no source saying the loader steals browser passwords itself. IcedID, which it can fetch, is a banking trojan, so treat saved passwords as exposed if the PC was infected for a while.

Passwords and accounts

We found no source saying the loader steals browser passwords itself. IcedID, which it can fetch, is a banking trojan, so treat saved passwords as exposed if the PC was infected for a while.

Medium Remote control MITRE lists VNC among the techniques, and Netresec describes a BackConnect function. That is a way for a person to use the PC live.

MITRE lists VNC among the techniques, and Netresec describes a BackConnect function. That is a way for a person to use the PC live.

Low Nothing, if you only saw the name A news article, a blocklist or a warning with this name does not mean your PC is infected.

Nothing, if you only saw the name

A news article, a blocklist or a warning with this name does not mean your PC is infected.

What you may notice, and what you may not

A loader is built to be quiet, and most victims see nothing until the second stage arrives. The signs below follow from the behaviour in the sources.

How to check the PC for Latrodectus (Windows loader, also called IceNova and BlackWidow)

Traces it leaves, for a manual check

These names come from Elastic's analysis of one 2024 sample. A newer build may use other names, so a clean does not clear the PC. Use them as places to look, not as a complete list.

MITRE names registry Run keys and the Startup folder as ways the family can start again after a restart, in addition to scheduled tasks. In practice check three places: Task Scheduler, Settings > Apps > Startup , and the key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run . Write down what you find before you delete anything.

Nobody downloads Latrodectus on purpose. The routes below are the ones the sources name, and they all begin with something a person opens or runs.

1 An email with an attachment or a link MITRE lists spearphishing attachments and spearphishing links. The Microsoft report of April 2025 on tax themed phishing, linked by Malpedia to Storm-0249, shows how the lure follows the season.

An email with an attachment or a link

MITRE lists spearphishing attachments and spearphishing links. The Microsoft report of April 2025 on tax themed phishing, linked by Malpedia to Storm-0249, shows how the lure follows the season.

2 A ClickFix page Malpedia lists a CERT.PL report from February 2026 on a ClickFix campaign. In such an attack a page says you must fix something and asks you to press Windows key and R, then paste a command. That command is the infection. We do not know if every ClickFix case with this name used the same page.

Malpedia lists a CERT.PL report from February 2026 on a ClickFix campaign. In such an attack a page says you must fix something and asks you to press Windows key and R, then paste a command. That command is the infection. We do not know if every ClickFix case with this name used the same page.

3 Delivery by another botnet eSentire reported in December 2023 that DanaBot was deploying it. Loaders often pass victims along to each other.

Delivery by another botnet

eSentire reported in December 2023 that DanaBot was deploying it. Loaders often pass victims along to each other.

4 Messaging services Malpedia lists a 2025 analysis of delivery through the Telegram bot interface. The details are not in the pages we read.

Malpedia lists a 2025 analysis of delivery through the Telegram bot interface. The details are not in the pages we read.

Check your PC before you delete anything

Start with the question that matters: did you open an unexpected attachment, run a JavaScript file or paste a command from a web page in the last weeks? If yes, or if you are not sure, do the checks below. None of them deletes anything. Stop using the PC for banking, email, work or crypto while you check, and if it is a work PC tell your IT team now.

1 Disconnect first Turn off Wi-Fi or unplug the cable. A loader needs the connection to receive its orders, and the sooner it is cut the less can arrive.

Turn off Wi-Fi or unplug the cable. A loader needs the connection to receive its orders, and the sooner it is cut the less can arrive.

2 Open Task Scheduler Press Start , type Task Scheduler and open it. Look in Task Scheduler Library for a task named Updater or any task with a random name that runs a program from your user profile. Note the name and the program it runs. Do not delete yet.

Press Start , type Task Scheduler and open it. Look in Task Scheduler Library for a task named Updater or any task with a random name that runs a program from your user profile. Note the name and the program it runs. Do not delete yet.

3 Look in the profile folder Open File Explorer, type %APPDATA% in the address bar and press Enter. Look for a folder called Custom_update or a folder with a number as its name, such as the one Elastic describes for the IcedID handler. Do not open files inside. A hit is strong; a miss does not clear the PC, because other builds can use other names.

Look in the profile folder

Open File Explorer, type %APPDATA% in the address bar and press Enter. Look for a folder called Custom_update or a folder with a number as its name, such as the one Elastic describes for the IcedID handler. Do not open files inside. A hit is strong; a miss does not clear the PC, because other builds can use other names.

4 Check startup entries Open Settings > Apps > Startup and look for names you did not install. Also check the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run , which MITRE lists among the places the family uses. Changing the registry is a risk: only look, and write down the values.

Check startup entries

Open Settings > Apps > Startup and look for names you did not install. Also check the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run , which MITRE lists among the places the family uses. Changing the registry is a risk: only look, and write down the values.

5 Look at running processes Open Task Manager and the Processes tab. Look for rundll32.exe that you did not start, or an unknown name with network use. Right click a process and choose Open file location to see where it lives. rundll32.exe is a genuine Windows file, so the folder of the DLL it loads is what matters.

Look at running processes

Open Task Manager and the Processes tab. Look for rundll32.exe that you did not start, or an unknown name with network use. Right click a process and choose Open file location to see where it lives. rundll32.exe is a genuine Windows file, so the folder of the DLL it loads is what matters.

6 Open Protection history In Windows Security > Virus & threat protection > Protection history , look for anything blocked or quarantined at the time you opened the file. We found no published Microsoft name for Latrodectus, so look for any script or loader detection around that time.

Open Protection history

In Windows Security > Virus & threat protection > Protection history , look for anything blocked or quarantined at the time you opened the file. We found no published Microsoft name for Latrodectus, so look for any script or loader detection around that time.

7 Check your accounts from another device Look at the sign in activity of your email, bank and work accounts from a different device. This is quicker than any file check and tells you if the operator has already moved.

Check your accounts from another device

Look at the sign in activity of your email, bank and work accounts from a different device. This is quicker than any file check and tells you if the operator has already moved.

8 A scan helps, but it does not clear the PC A Microsoft Defender scan can find known files. Treat a clean result like a clean site test: one data point. We did not infect a PC, so the order here is our judgement from Microsoft's general recovery pages and the vendor write-ups, not a tested result.

A scan helps, but it does not clear the PC

A Microsoft Defender scan can find known files. Treat a clean result like a clean site test: one data point. We did not infect a PC, so the order here is our judgement from Microsoft's general recovery pages and the vendor write-ups, not a tested result.

How to remove Latrodectus (Windows loader, also called IceNova and BlackWidow)

How to remove Latrodectus

A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.

1 Step 1 : Delete scheduled tasks that bring it back Open Task Scheduler from the Start and click Task Scheduler Library . Select each task you do not recognise and read the Actions tab: a task that starts a file in %AppData% or %Temp% runs powershell with a long encoded line opens a web address belongs to Latrodectus or a similar program Right-click such a task and choose Delete , and check the subfolders too. Leave tasks from Microsoft, your PC's maker and programs you use. Task Scheduler is the same in Windows 11 and Windows 10. Full procedure with screenshots: Remove what malware leaves behind in Windows

Step 1 : Delete scheduled tasks that bring it back

Open Task Scheduler from the Start and click Task Scheduler Library . Select each task you do not recognise and read the Actions tab:

a task that starts a file in %AppData% or %Temp%

runs powershell with a long encoded line

opens a web address belongs to Latrodectus or a similar program

Right-click such a task and choose Delete , and check the subfolders too. Leave tasks from Microsoft, your PC's maker and programs you use. Task Scheduler is the same in Windows 11 and Windows 10.

Full procedure with screenshots: Remove what malware leaves behind in Windows

2 Step 2 : Remove it from startup Whatever Latrodectus installed usually starts with Windows. Open Task Manager with Ctrl + Shift + Esc , go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column. Open file location on the right-click shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on. Full procedure with screenshots: Stop apps from opening at startup On uGetFix

Step 2 : Remove it from startup

Whatever Latrodectus installed usually starts with Windows. Open Task Manager with Ctrl + Shift + Esc , go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column.

Open file location on the right-click shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on.

Full procedure with screenshots: Stop apps from opening at startup On uGetFix

3 Step 3 : Delete the folders left behind What the uninstaller leaves behind is usually in the user folders. Open File Explorer, switch on View > Show > Hidden items (in Windows 10 View > Hidden items ), and go through %LocalAppData% , %AppData% , %ProgramData% and the two Program Files folders. Sort by Date modified and delete folders that appeared together with the problem and belong to no program you use. Folders with random names that hold .exe , .dll , .js or .ps1 files are the strongest sign. Full procedure with screenshots: Remove what malware leaves behind in Windows

Step 3 : Delete the folders left behind

What the uninstaller leaves behind is usually in the user folders. Open File Explorer, switch on View > Show > Hidden items (in Windows 10 View > Hidden items ), and go through %LocalAppData% , %AppData% , %ProgramData% and the two Program Files folders.

Sort by Date modified and delete folders that appeared together with the problem and belong to no program you use. Folders with random names that hold .exe , .dll , .js or .ps1 files are the strongest sign.

Full procedure with screenshots: Remove what malware leaves behind in Windows

4 Step 4 : Scan the PC, then run the offline scan Open Windows Security > Virus & threat protection > Scan options , run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now : the PC restarts and scans before Windows loads, which finds files that hide while Windows runs. Save your work first, because the offline scan takes 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion. Full procedure with screenshots: Run a Microsoft Defender Offline scan

Step 4 : Scan the PC, then run the offline scan

Open Windows Security > Virus & threat protection > Scan options , run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now : the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.

Save your work first, because the offline scan takes 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.

Full procedure with screenshots: Run a Microsoft Defender Offline scan

5 Step 5 : Change passwords from another device and sign out other sessions Assume that the passwords saved in this PC's browsers, and the accounts that were open in them, are known to the attacker. From a phone or a clean computer, change the e-mail password first, then banking, shopping, social and gaming accounts. Use each service's option to sign out of all other sessions, because stolen cookies keep a session open even after a password change. Turn on two-step verification on each account. Wait with the infected Windows 11 or Windows 10 PC until the scans are clean. Full procedure with screenshots: Turn on two-step verification / secure a hacked account

Step 5 : Change passwords from another device and sign out other sessions

Assume that the passwords saved in this PC's browsers, and the accounts that were open in them, are known to the attacker. From a phone or a clean computer, change the e-mail password first, then banking, shopping, social and gaming accounts.

Use each service's option to sign out of all other sessions, because stolen cookies keep a session open even after a password change. Turn on two-step verification on each account. Wait with the infected Windows 11 or Windows 10 PC until the scans are clean.

Full procedure with screenshots: Turn on two-step verification / secure a hacked account

If you use a Mac, an iPhone or an Android phone

Every source we read describes Latrodectus as Windows malware, and MITRE lists the platform as Windows.

After removal: passwords, accounts and prevention

If it ran: clean the PC and protect what it could reach

The PC is one half; the accounts it could see are the other. Because a loader hands the PC to unknown buyers, the safest answer for a PC that really ran it is a full reset. The order matters: another device first, then the PC.

1 Tell your work or your bank if it matters If it is a company PC, report it to IT before you do anything else: a loader that reports the domain can lead to a network wide incident. If you banked on the PC, call your bank from another phone.

Tell your work or your bank if it matters

If it is a company PC, report it to IT before you do anything else: a loader that reports the domain can lead to a network wide incident. If you banked on the PC, call your bank from another phone.

2 Change passwords from a clean device Start with email because it resets everything else, then bank, work, cloud storage and crypto. Do not type new passwords on the suspect PC. Turn on two step sign in and sign out other sessions where the service offers it.

Change passwords from a clean device

Start with email because it resets everything else, then bank, work, cloud storage and crypto. Do not type new passwords on the suspect PC. Turn on two step sign in and sign out other sessions where the service offers it.

3 Move crypto first if a wallet was on the PC If a seed phrase or wallet file was ever on the PC, assume it is known. Make a new wallet on a clean device and move the funds.

Move crypto first if a wallet was on the PC

If a seed phrase or wallet file was ever on the PC, assume it is known. Make a new wallet on a clean device and move the funds.

4 Run Microsoft Defender Offline Open Windows Security > Virus & threat protection > Scan options , choose Microsoft Defender Offline scan and select Scan now . Save your work first; Windows restarts for the scan. If BitLocker is on, have the recovery key ready.

Run Microsoft Defender Offline

Open Windows Security > Virus & threat protection > Scan options , choose Microsoft Defender Offline scan and select Scan now . Save your work first; Windows restarts for the scan. If BitLocker is on, have the recovery key ready.

5 Remove the traces you found If the check found the Updater task or a file in Custom_update , delete the task in Task Scheduler and the folder in File Explorer. Take care: if you are not sure what an entry is, leave it and use the reset below. Deleting the visible copy does not remove a second stage that was already downloaded.

Remove the traces you found

If the check found the Updater task or a file in Custom_update , delete the task in Task Scheduler and the folder in File Explorer. Take care: if you are not sure what an entry is, leave it and use the reset below. Deleting the visible copy does not remove a second stage that was already downloaded.

6 If you are not sure, reset Windows Open Settings > System > Recovery > Reset this PC . Keep my files removes apps and settings and keeps personal files. Remove everything wipes the PC and is the choice that does not depend on finding every piece. Back up documents first.

If you are not sure, reset Windows

Open Settings > System > Recovery > Reset this PC . Keep my files removes apps and settings and keeps personal files. Remove everything wipes the PC and is the choice that does not depend on finding every piece. Back up documents first.

7 Restore only documents by hand Copy back documents and photos, not programs, and not a full system image from after the first . Install apps from their makers' own sites.

Restore only documents by hand

Copy back documents and photos, not programs, and not a full system image from after the first . Install apps from their makers' own sites.

8 Watch your accounts for weeks Check card statements and sign in logs. If you live in the United States you can report stolen personal data at IdentityTheft.gov; in other countries use your national cybercrime or consumer report site.

Watch your accounts for weeks

Check card statements and sign in logs. If you live in the United States you can report stolen personal data at IdentityTheft.gov; in other countries use your national cybercrime or consumer report site.

Keep a PC out of this kind of chain

Every route in the sources starts with something a person opens or pastes. That is where the defence is.

Treat an unexpected attachment or a link a tax form, a copyright claim or an invoice as hostile until you have checked it with the sender in another way.

Show file endings in File Explorer so a .js or .hta file posing as a document is visible.

Keep Windows and Microsoft Defender updated.

Use a password manager and two step sign in, so one stolen password is not enough.

Keep a backup of documents on a disk that you unplug.

On a work PC report a strange pop-up or page to IT the same day.

Never press Windows key and R and paste a command that a web page told you to paste.

Do not open JavaScript, script or shortcut files that arrive by email.

Do not run cracked programs or installers from unknown sites.

Do not change your passwords on the PC you suspect.

Do not rely on a quiet scan to say you are safe.

Questions Latrodectus (Windows loader, also called IceNova and BlackWidow)

What is Latrodectus malware?

Latrodectus is a Windows loader, also called IceNova or BlackWidow, first seen in October 2023. MITRE describes it as a downloader that fetches and runs further payloads, mostly spread by email campaigns.

Malpedia calls it a backdoor that talks to its server over encrypted HTTP and says LUNAR SPIDER, the group behind IcedID, is believed to have developed it. It is not a program you install on purpose, and it exists to bring other malware onto your PC.

Is Latrodectus a virus?

Strictly it is a trojan loader, not a virus that copies itself from file to file. It needs a person to open a lure or paste a command, and then it downloads other malware.

It is dangerous: vendors link it to IcedID and to ransomware activity. If you only read the name in an article or a log, nothing is wrong with your PC. If you ran an unexpected file or command, follow the checks on this page.

How does Latrodectus get onto a PC?

MITRE names spearphishing attachments and links. Malpedia lists tax themed phishing from April 2025, delivery by DanaBot in 2023 and a ClickFix campaign reported in February 2026, where a page asks you to paste a command into Windows.

In each case a person starts the first step. We did not see the October 2026 samples, so we cannot say which route those entries belong to.

How do I remove Latrodectus from Windows?

Disconnect the PC and change your passwords from another device. Then run a Microsoft Defender Offline scan, check Task Scheduler for a task named Updater, look in the AppData Roaming folder for Custom_update, and remove what you can tie to the malware.

If you are not sure, or the PC is a work machine, reset Windows with Remove everything and restore only documents. We followed general Windows recovery steps and did not test them on an infected PC.

What files and tasks does Latrodectus create?

In the 2024 sample Elastic analysed, it copied itself to AppData Roaming Custom_update as a DLL named Update_ plus digits, wrote update_data.dat beside it and made a scheduled task called Updater that runs at logon.

The packed file was called TRUFOS.SYS. Newer builds may use other names, so these are places to look. MITRE also lists registry Run keys and the Startup folder as persistence for the family.

What does Latrodectus steal?

We found no source saying the loader itself steals passwords. It collects system details, such as the Windows version, user, computer name and domain, lists desktop files, and sends them to its server. Its real harm is what it downloads :

Treat saved passwords and wallets as exposed if the PC was infected for some time, and change them from another device.

Is Latrodectus the same as IcedID?

No, but they are close relatives. Malpedia says Latrodectus is believed to come from LUNAR SPIDER, the group behind IcedID.

Elastic found that Latrodectus can download and run an IcedID payload through a dedicated command, and called it a possible IcedID replacement. They are separate families with different code, and a PC may carry one, the other or both.

Does Latrodectus affect Mac, iPhone or Android?

We found nothing that says so. MITRE lists Windows as the platform, and the techniques named in the sources, such as rundll32, WMI and scheduled tasks, are Windows features.

On a Mac, iPhone or Android phone there is nothing to remove for this threat. If you typed a password on a suspicious page, change it.

I saw the name in an alert. Am I infected?

Not necessarily. An alert from Defender, a firewall or a SOC tool means something matched, and the device named in it is the one to check.

Disconnect that device, look at Task Scheduler, the AppData Roaming folder and Protection history, and run a Microsoft Defender Offline scan. If a company owns the device, hand it to IT. A clean check is only one data point, not proof.

Will Fortect remove Latrodectus?

Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.

For Latrodectus, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.

Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.

Elastic Security Labs: Spring cleaning with LATRODECTUS (16 May 2024) ( read October 25, 2026 )

MITRE ATT&CK: Latrodectus, S1160 (modified 30 September 2024) ( read October 25, 2026 )

Malpedia: Latrodectus (win.latrodectus) ( read October 25, 2026 )

abuse.ch ThreatFox: entries for the malware name Latrodectus (data held in our radar, latest entry 21 October 2026) ( read October 25, 2026 )