New OnionDrop Loader Campaign Uses gainmsg C2 to Deliver LegionLoader Payloads

Cybersecuritynews •Tushar Subhra Dutta • June 17, 2026

A newly identified loader campaign is raising serious concerns across the cybersecurity community. Threat researchers have uncovered an active operation using a sophisticated multi-stage loader called OnionDrop, which is being used to deliver harmful payloads, including the well-known LegionLoader, to a broad range of victims at scale. OnionDrop has been quietly operating since at least […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OnionDrop Loader Campaign Delivers LegionLoader and Infostealers at Scale A new loader campaign, OnionDrop, is actively delivering malicious payloads, including LegionLoader and multiple infostealers, to a wide range of victims. Researchers identified over 645 unique DLL samples associated with OnionDrop between February 28 and May 20, 2026. The campaign employs sophisticated DLL sideloading techniques to evade detection and has been operational since at least early 2026. Current deliveries remain active, indicating a significant ongoing threat to various systems. The scale of the operation and its advanced evasion methods raise serious concerns within the cybersecurity community. 2 sources 68

Extracted Entities

New OnionDrop Loader Campaign Uses gainmsg C2 to Deliver LegionLoader Payloads

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (2)

MITRE ATT&CK (1)