New Malware Loaders Use Call Stack Spoofing, GitHub C2, and .NET Reactor for Stealth

Hijack Loader released a new module that implements call stack spoofing to hide the origin of function calls (e.g., API and system calls). The attack chain involves the use of a phishing email as a starting point.