Amadey Malware Distributed via SmokeLoader: Threat Analysis

• •Amadey malware is being distributed via SmokeLoader, primarily targeting Windows systems.
• •The malware can steal sensitive information and install additional malicious software.
• •Recent data shows increased activity and indicators of Amadey in threat intelligence platforms.

Amadey malware, a Windows trojan bot first identified in 2018, is currently being distributed through SmokeLoader, a malware known for delivering additional malicious payloads. This malware family can steal information and install further malware by executing commands from remote attackers. Recent statistics indicate that SmokeLoader has been prevalent in malware distribution, particularly disguised as software cracks. The AhnLab ASEC team has linked Amadey to various cybercriminal groups, including those behind ransomware attacks. As of October 21, 2026, there have been multiple indicators and samples of Amadey detected in threat intelligence databases. Users are advised to remain vigilant against potential infections, especially from suspicious downloads. The current scope of impact appears to be growing, with ongoing distribution efforts noted in recent weeks.