SmartLoader

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: win.smartloader

Threat Analysis

SmartLoader is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Intelligence Reports Mentioning SmartLoader

SmartLoader Attack Uses Trojanized Oura MCP Server to Deploy StealC Infostealer

The Hacker News· Feb 17, 2026

External References

→https://asec.ahnlab.com/en/89551/

→https://github.com/SecurityBlueTeam/Smartloader_Wireshark

→https://hexastrike.com/resources/blog/threat-intelligence/cloned-loaded-and-stolen-how-109-fake-github-repositories-delivered-smartloader-and-stealc/

→https://research.openanalysis.net/github/lua/2024/03/03/lua-malware.html

→https://www.mcafee.com/blogs/other-blogs/mcafee-labs/redline-stealer-a-novel-approach/

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

win.smartloaderSmartLoader

External Intelligence

Malpedia: win.smartloader

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search SmartLoader