HijackLoader/IDAT DLL Sideloading via ClickFix Infection Chain

Ibrahim Saud@tektrix

•updated Jul 3, 2026•5•0•20

Detects module loads of suspected malicious DLLs (associated with HijackLoader/CastleLoader or ClickFix campaigns) by signed host processes from non-standard user-writable directories like ProgramData. It also monitors for the execution of known sideloading host binaries (e.g., ssh-add.exe) from suspicious staging directories.