Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Spoofed Global Protect Used to Deliver Unique Wiki Loader Variant

Summary: Unit 42's Managed Threat Hunting team identified a WikiLoader variant delivered in June 2024 through SEO poisoning and spoofed GlobalProtect VPN installers, using cloned websites and cloud-based Git repositories. The spoofed installer hides more than 400 files, sideloads the first WikiLoader component through a renamed legitimate share trading application, injects decrypted shellcode into explorer.exe, and contacts a compromised WordPress site as C2 before tasking through MQTT brokers.

What's compelling: WikiLoader is a loader for rent suspected to be used by at least two initial access brokers, and spoofing trusted security software like GlobalProtect is likely to bypass endpoint controls at organizations that rely on filename-based allow listing.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026