RATs and stealers rush through “Heaven’s Gate” with new loader
Summary: Cisco Talos discovered a new campaign in which a complex loader delivers the HawkEye Reborn keylogger and other malware, using the "Heaven's Gate" technique to let 32-bit malware on 64-bit systems switch to a 64-bit environment and hide API calls. The same loader was also observed delivering Remcos and cryptocurrency mining trojans, with the final payload never written to disk and injected into the legitimate RegAsm.exe process via process hollowing.
What's compelling: The loader relies on techniques like Heaven's Gate and direct syscalls that some antivirus products and debuggers miss, and Talos notes that cybercriminals who lack the expertise to build this natively can simply rent or reuse available loaders to get the same evasion.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026