Executive Summary
WinLol is a newly identified four-stage malware toolkit observed between July and August 2026. The infection chain begins with a Rust-based dropper that performs sophisticated anti-sandbox checks, including timing and server-clock drift detection, and uses a server-side kill switch to manage active infections. The final payload is a Go-based Remote Access Trojan (RAT) that utilizes WebRTC for screen streaming, masquerading as a Riot Games client to blend into gaming-related environments.
Technically, the malware demonstrates high operational maturity by using in-memory execution for its second-stage downloader and employing DLL side-loading (via a hijacked `version.dll` and legitimate `OneDrive.exe`) to execute the RAT. It further evades detection by stripping Mark-of-the-Web (MotW) attributes and bypassing User Account Control (UAC) using the CMSTPLUA COM interface. While weak indicators like Chinese language artifacts in decoy documents and internal keys suggest a possible Chinese-speaking developer, definitive attribution is currently unavailable.
The use of WebRTC for streaming and the multi-stage delivery through signed binaries significantly raises the difficulty of detection for standard security controls. Organizations in the gaming sector or those with high OneDrive usage should monitor for the specific persistence and sideloading artifacts described in this analysis.