C2Looper Backdoor Uses OneDrive DLL Sideloading to Evade Detection

C2Looper backdoor represents a new and evolving threat targeting Windows systems, exploiting Microsoft OneDrive DLL sideloading to evade detection. Zscaler ThreatLabz first identified this malware in July 2026, and their in-depth analysis reveals how C2Looper leverages trusted processes and cloud services to persist undetected, making it a significant concern for organisations of all sizes.

C2Looper Backdoor: Discovery and Delivery via ClickFix Chains

The C2Looper backdoor surfaced during Zscaler’s investigations in July 2026, with public details published on 17 August 2026. Zscaler assesses, with low to medium confidence, that C2Looper is linked to ransomware-related actors. The malware is observed spreading through multi-stage ClickFix social engineering campaigns. In these campaigns, users are tricked into running attacker-supplied commands, typically masked as fixes for browser or system issues. This technique has been seen in several recent malware campaigns and remains effective due to the trust users place in technical instructions.

The initial payload grants operators remote command execution, host reconnaissance, and the ability to deliver additional malicious software. C2Looper’s feature set is intentionally minimal, enabling attackers to establish a durable foothold within Windows environments and facilitating subsequent lateral movement or further compromise.

• Discovery: Identified by Zscaler in July 2026 and disclosed in August.
• Delivery method: Multi-stage ClickFix campaigns requiring user interaction.
• Threat actor linkage: Suspected ransomware-related, but no confirmed attribution.

Technical Analysis: OneDrive DLL Sideloading Update Mechanism

One of the most notable features of C2Looper is its update mechanism, which abuses Microsoft OneDrive’s DLL sideloading behaviour. In older variants, upon receiving an update command, the malware fetches a new payload and writes it as wtsapi32.dll within the user’s OneDrive directory at %LocalAppData%\Microsoft\OneDrive. The implant then terminates the legitimate OneDrive process and relies on OneDrive.exe to reload, at which point it sideloads the attacker’s malicious DLL. This allows the backdoor to persist and update itself seamlessly within a trusted and frequently running process, significantly reducing the likelihood of detection by endpoint security tools.

This sideloading approach exploits the default DLL search order behaviour in Windows, where applications may load libraries from their own directories. By choosing OneDrive—a ubiquitous and trusted process on many business machines—C2Looper operators blend their activity into normal operations. The visible process appears legitimate, even while executing malicious code.

• Malicious DLL path: %LocalAppData%\Microsoft\OneDrive\wtsapi32.dll
• Process manipulation: OneDrive.exe is stopped and restarted to trigger sideloading.
• Stealth factors: Runs inside a trusted process, hiding malicious activity.

Core Capabilities and Communication Methods

C2Looper provides essential backdoor capabilities, including:

• Remote command execution using cmd.exe
• Host profiling (collecting username, DNS hostname, and process details)
• Fetching and executing additional payloads

Earlier variants communicate over plaintext HTTP, using a simple JSON protocol. The malware posts detailed host information and regularly polls for new tasks via endpoints such as /api/beacon and /api/result/BOT_ID/task_ID. Command outputs are typically captured to local files before being uploaded to the command and control (C2) server.

Evolution: GitHub-Based Command and Control in Newer Variants

In response to evolving detection techniques, C2Looper’s developers have shifted to a more covert command and control scheme in version 2 of the malware. Instead of using dedicated attacker infrastructure, the newer variant leverages GitHub repositories for communication. Each victim host interacts with a unique directory within a repository, exchanging files such as cmd.json for tasking, result.json for output, and beacon.json for status updates. This approach blends malicious traffic with legitimate GitHub usage, complicating detection and blocking efforts.

• C2 via GitHub: Removes reliance on attacker-owned domains.
• Repository structure: Each host uses a private directory for instructions and responses.
• Ongoing development: Zscaler notes improved parsing and beacon formats in recent builds.

GitHub-based C2 makes it difficult for defenders to distinguish malicious from benign traffic, especially in environments where developer tools are permitted. This technique also provides resilience, as cloud platforms are less likely to be blocked outright by organisational firewalls.

Indicators of Compromise and Detection Strategies

C2Looper’s use of DLL sideloading and cloud-based C2 presents unique detection challenges. However, several indicators can help defenders identify infections:

• Presence of wtsapi32.dll in %LocalAppData%\Microsoft\OneDrive
• Unexpected restarts or behaviour of OneDrive.exe, especially loading DLLs from user directories
• Out-of-pattern GitHub repository access, particularly involving files named cmd.json, result.json, and beacon.json by non-developer processes
• Frequent HTTP polling to endpoints like /api/beacon on external servers (for older variants)

Zscaler’s public reporting did not include specific hashes or IPs, but defenders are advised to monitor for these artefacts and inspect process behaviour, especially related to OneDrive and GitHub usage on endpoints where such activity is unusual.

Why C2Looper Matters and Immediate Steps for Organisations

C2Looper’s ability to operate within trusted processes and use cloud-based C2 channels increases the risk of prolonged undetected presence, especially in environments that rely on Microsoft 365 and permit GitHub access. The malware’s ongoing development and observed use by ransomware-related actors heighten its significance for incident response teams.

Organisations should:

• Monitor OneDrive process activity and investigate unexpected DLL loads from user directories
• Review GitHub access logs for anomalous repository usage on non-developer machines
• Update application control and attack surface reduction (ASR) policies to restrict unauthorised DLL loading and outbound cloud service access where feasible

Originally reported by cybersecuritynews.com.