SessionGate Loader C2 User-Agent

Duo Tech@duotech

•updated Jun 3, 2026•0•0•10

Detects the specific User-Agent string 'NSIS_InetLoad (Mozilla)' associated with the SessionGate multi-stage loader during its command and control (C2) check-ins. SessionGate is delivered via impersonated open-source tooling websites and gated TDS redirection chains.