Cosmali Loader

Malware

Threat entity extracted from intelligence sources

Frequency

2

occurrences

First Seen

December 24, 2025

Last Seen

December 26, 2025

Cosmali Loader is a Windows-based malware loader that delivers PowerShell-based payloads.

Overview

Recent Events

Relationships

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Related Clusters (1)

Typosquatted Domains Spread Cosmali Loader via PowerShell Malware

Dec 26·2 sources

Related Articles (2)

Fake Windows activation domains used to spread PowerShell malware

Gigazine·Dec 26

Fake MAS Windows activation domain used to spread PowerShell malware

Bleepingcomputer·Dec 24

Related Entities

Malware Trojan XWorm T1059.001 - PowerShell Windows PowerShell TSforge Ohook