Back Broadcom

Vidar and Remus infostealers distributed with help of new 2CLoader

Broadcom • October 2, 2026

Zscaler ThreatLabz uncovered a previously undocumented loader malware dubbed 2CLoader. This modular loader has been observed facilitating the delivery of credential-harvesting tools including Vidar and Remus, alongside the XWorm malware strain. The loader stands out due to its advanced defensive mechanisms designed to confound analysts and bypass endpoint protections. It executes a wide spectrum of evasion protocols, spanning virtual machine detection, debugger identification, and user engagement verifications, inline trampoline API hooks as well as indirect system calls.

Symantec protects you from this threat, identified by the following:

Associated malicious indicators are blocked and detected by existing policies within Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from Carbon Black Cloud reputation service.

Machine Learning-based

Observed domains/IPs are covered under security categories in all WebPulse enabled products

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

2CLoader Malware Loader Distributes Vidar and Remus Infostealers Zscaler ThreatLabz has identified a new malware loader named 2CLoader, which is used to deliver infostealers Vidar and Remus, as well as XWorm RAT. The loader employs advanced evasion techniques to bypass security measures, including indirect system calls and anti-debugging checks. Organizations are advised to enhance their endpoint security to detect these evasive tactics. Specific indicators of compromise (IOCs) include connections to the domain aware-cr1[.]com. The threat is significant due to its modular nature and ability to adapt to various environments. Security teams should monitor for suspicious scheduled tasks and registry changes associated with 2CLoader. If detected, isolating affected hosts and conducting memory forensic analysis is recommended. The current status indicates ongoing risks as the loader remains active in the wild. 2 sources 68

Vidar and Remus infostealers distributed with help of new 2CLoader

The full story

Extracted Entities

Attack Types (1)

Malware (4)