A New Malware Loader Checks Your Graphics Card Before It Attacks

What Happened? 

Security researchers at Cyderes, working through their Howler Cell threat research team, just published a breakdown of OnionDrop, a loader that has been active since February and has already produced more than 645 unique malicious files. The campaign is still running, and analysts say its evasion design rivals tools normally built by nation state hacking groups, not run of the mill cybercriminals.

The attack starts with a ZIP file. Inside sits a legitimate Adobe signed executable alongside two malicious DLL files and a 100 megabyte decoy file stuffed with random data to make the archive harder to analyze.

Once someone runs the Adobe file, it loads one of the malicious DLLs, which kicks off a four stage unpacking process involving custom encoding, compression, encryption with rotating keys, and a final step that runs through a Windows feature called Thread Pool callbacks instead of the usual methods security tools watch for.

Before any of that happens, the loader checks the system’s graphics hardware against a list of real GPU brands. If the machine looks like a virtual sandbox, the attack stops cold.

Once it clears those checks, OnionDrop reaches out to a command and control server at gainmsg dot com to fetch its final payload. Researchers have already linked it to three different threats. LegionLoader, also known as CurlyGate, a stealer called CGrabber, and the well known Vidar infostealer. That flexibility suggests one group is running several data theft operations at once using the same delivery system.

The Impact 

What makes this worth watching is not just the malware itself, but what it represents. Attackers are spending real engineering time on loaders that exist purely to get past detection, then handing off to whatever payload makes the most money that week. For businesses, that means a single infected machine can quietly leak browser passwords, saved logins, and session data before anyone notices anything wrong.

How to Avoid This 

• Security teams should watch for Adobe signed executables launching unexpected DLLs, flag any process using Thread Pool callbacks in unusual ways, and block known indicators tied to the gainmsg domain. Basic hygiene still matters too.
• Treat unexpected ZIP files from email or downloads with suspicion, and keep endpoint tools updated so they can catch sideloading behavior even when the loader looks legitimate on the surface.