KoiLoader Reloaded: New Variant Uses LNK Abuse, Script Chains, and PowerShell to Deliver Stealer Payload

Researchers at eSentire spotted a new KoiLoader variant using phishing, LNK file abuse, PowerShell, and layered scripts to evade detection, gain persistence, and deliver KoiStealer malware for data theft via encrypted C2 communication.