Operation Turb00 HijackLoader DLL sideload: signed host binary loads trojanized DLL from unusual path

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•1

Detects DLL side-loading activity associated with Operation Turb00's IDAT Loader, used to deploy the Vidar infostealer. The rule identifies specific legitimate host binaries (e.g., AlphVector.exe, ssh-add.exe) executing from non-standard directories like ProgramData, AppData, or Temp and loading unsigned or untrusted DLLs known to be trojanized.