Amadey Loading Credential-Stealing Plugin cred.dll via rundll32.exe

Ethan Andrews@eandrews

•updated Jun 24, 2026•0•0•6

Detects Amadey loader executing its credential-theft plugin (cred.dll) via rundll32.exe with the Main export, triggered by Amadey backdoor command 0x15 after downloading cred.dll from the C2 /Plugins/ path.