A Deep Dive into Lokibot Infection Chain
Summary: Cisco Talos detailed a Lokibot infection chain that begins with a phishing email carrying a malicious XLS attachment with an obfuscated macro, which downloads a packed second-stage downloader that fetches an encrypted third stage containing three layered encrypted Lokibot payloads. The chain uses a Spanish-language lure about scheduled payment dates, a blurred table image prompting the victim to click "Enable Content," a time-based anti-debug check before downloading, and DLL injection into Notepad.exe along with a UAC bypass attempt. The third stage decrypts a resource named DVCLAL with the hardcoded key 7x21zoom8675309 and recovers its configuration using a custom delimiter string.
Key Takeaway: The whole chain hinges on a user clicking "Enable Content" on an attachment that looks like a routine payment notice, and the malware then injects into Notepad.exe and attempts a UAC bypass to reach C:\Windows\Finex - so the question is whether your controls catch a signed, everyday process like Notepad loading an unexpected DLL.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026