Infostealer Clipboard Hijacker - clip64.dll Clipper Plugin or Suspicious AppData DLL via rundll32

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects the loading of DLLs by rundll32.exe from non-standard user-writable directories (AppData, Temp), often associated with infostealer clipper plugins such as clip64.dll. These patterns are commonly used by malware families like Amadey, LokiBot, and Lumma Stealer to maintain persistence or execute malicious functionality via legitimate Windows binaries.