SmokeLoader and Amadey are commodity loaders: their job is to land on a Windows host and then install whatever their customers pay for, so one infection usually means several more families arriving within hours. SmokeLoader (also tracked as Smoke and Dofoil) has been sold as a crimeware kit since 2011; Amadey has been advertised on criminal forums since October 2018. Both sit in the pay per install economy, where loader operators and affiliates sell installs on infected machines to infostealer, ransomware and cryptomining operators. Both were targets of Operation Endgame actions, SmokeLoader in May 2024 and Amadey in June 2026. This guide covers how the two families work at recognition level, the ATT&CK v20 techniques recorded against S0226 and S1025, what an infection means for the credentials and tokens on a host, and the detections, controls and response steps that hold up as builds change. It is for SOC analysts, detection engineers and endpoint owners. The loader class in general is covered in the Malware Loaders and Droppers Guide; this page goes deeper on these two families only.
Key takeaways
- Treat a loader as the first of many infections: Cisco Talos saw one Amadey-linked operation deliver SmokeLoader, Redline, Lumma, Rhadamanthys, StealC and AsyncRAT from the same hosting.
- The customer, not the author, picks the payload: Amadey licences are sold to affiliates who run their own panels, so the follow-on malware varies by campaign.
- Persistence is ordinary and detectable: MITRE records Run keys, Startup folder entries and scheduled tasks for both families, and Zscaler documents task names that imitate legitimate updaters.
- Credentials leave early: SmokeLoader plugins harvest browser and email credentials, and Amadey ships a credential-theft module, so rotate secrets as part of containment.
- Takedowns do not clean your estate: Endgame used SmokeLoader's own uninstall command where it could, but residues and follow-on payloads stay until you remove them.
Names, lineage and status
| Attribute | SmokeLoader | Amadey |
|---|---|---|
| ATT&CK ID and aliases | S0226; Smoke Loader, Dofoil | S1025; Amadey |
| First seen | At least 2011 (MITRE, Zscaler) | Advertised from October 2018 (ESET); used since at least October 2018 (MITRE) |
| Commercial model | Crimeware kit; leaked panel code and cracked builders widened use (Zscaler) | Licence of US$600 plus US$50 per rebuild, affiliates run own panels (ESET) |
| Modules | Plugins for credential harvesting, browser data theft and cryptomining (Zscaler) | Clipboard monitoring, credential theft and VNC remote access (ESET) |
| Recent payloads reported | Raspberry Robin, StealC, Stop ransomware (Zscaler) | StealC and other infostealers (ESET, Talos) |
| Groups linked in ATT&CK | None listed against S0226 | TA505 (G0092), Kimsuky (G0094) |
| Law enforcement action | Operation Endgame, 27 to 29 May 2024 (Europol) | Operation Endgame action reported 24 June 2026 (ESET) |
For the groups, see the TA505 Threat Actor Profile Guide and the Kimsuky Threat Actor Profile.
How the pay per install chain works
Pay per install splits the intrusion into businesses. A distributor gets the loader onto machines; the loader operator or affiliate sells installs; the buyer supplies the payload. The Malware-as-a-Service (MaaS) Economy Guide covers the market; three points matter for defenders here.
- Delivery is outsourced and varied: ESET names fake software updates, cracked software installers and third-party loaders as common routes for Amadey and StealC. Talos documented invoice-themed phishing archives with obfuscated JavaScript that started SmokeLoader, and loaders hosted in public GitHub repositories that fetched Amadey.
- Trusted hosting beats web filters: in the Talos case, operators used fake GitHub accounts as payload directories because many filters allow the domain. GitHub removed the accounts after Talos reported them.
- Each build is short-lived: Amadey carries one to three hardcoded C2 URLs per sample (ESET), and affiliates rebuild to rotate servers, so indicator lists age quickly.
The practical result is that the loader alert is the cheapest point to stop the chain. Once installs are sold, you may be dealing with an infostealer and a remote access trojan at the same time. See Infostealers vs Loaders.
Tactics and techniques (MITRE ATT&CK v20)
Every ID below is recorded in ATT&CK v20 against S0226 or S1025 and was checked against the v20 dataset. Tactic names follow v20.
| Tactic | Technique | Family | Primary defence |
|---|---|---|---|
| Execution | T1059.005 Visual Basic; T1053.005 Scheduled Task | SmokeLoader | Script host restrictions; task creation auditing |
| Persistence | T1547.001 Registry Run Keys / Startup Folder | Both | Alert on Run keys and Startup items pointing to user-writable paths |
| Persistence and defence impairment | T1112 Modify Registry | Amadey | Registry auditing on autostart and shell folder keys |
| Defence impairment | T1553.005 Mark-of-the-Web Bypass | Amadey | Alert on Zone.Identifier stream changes; application control |
| Stealth | T1055.012 Process Hollowing; T1027.013 Encrypted/Encoded File; T1140 Deobfuscate/Decode Files or Information | SmokeLoader (T1140 both) | EDR memory telemetry, especially explorer.exe |
| Stealth and discovery | T1497.001 System Checks | SmokeLoader | Realistic sandbox images plus EDR on real hosts |
| Discovery | T1518.001 Security Software Discovery; T1082 System Information Discovery; T1614 System Location Discovery | Amadey | Correlate discovery bursts after a download or archive open |
| Credential access | T1555.003 Credentials from Web Browsers; T1552.001 Credentials In Files | SmokeLoader | Enterprise password manager; block browser password saving |
| Collection | T1114.001 Local Email Collection | SmokeLoader | Protect mail profile stores; alert on access by unusual processes |
| Command and control | T1071.001 Web Protocols; T1105 Ingress Tool Transfer | Both | Proxy egress only; block uncategorised and newly registered domains |
| Command and control | T1568.001 Fast Flux DNS | Amadey | Protective DNS; alert on rapidly changing resolutions |
| Exfiltration | T1041 Exfiltration Over C2 Channel | Amadey | Per-host egress baselines |
Delivery techniques such as T1566.001 Spearphishing Attachment, T1204.002 Malicious File and T1059.001 PowerShell appear in the Talos campaign reporting but are not recorded against S0226 or S1025; map them to the campaign, not the malware. The ATT&CK software hub context is in the ATT&CK Loaders and Droppers Software Hub.
Where identity fits
Both families steal before they sell. SmokeLoader searches browser credential stores and logins.json files and collects Outlook data (MITRE), and Amadey has a dedicated credential-theft module (ESET). The follow-on payloads, StealC, Lumma and Rhadamanthys, take session cookies and tokens too. On developer and administrator workstations that reaches beyond people.
- Machine credentials on endpoints: cloud CLI profiles, API keys in config files, SSH keys and personal access tokens are readable by any process running as the user. See the Non-Human Identity (NHI) Guide.
- Session tokens bypass MFA: a stolen cookie replays an authenticated session. See Credential Theft vs Session Hijacking.
- Response scope: treat every secret readable from the host as exposed, including service account passwords and tokens for CI/CD and SaaS integrations.
Detection and defence
Host signals
| Signal | Family | Telemetry |
|---|---|---|
| Scheduled tasks named like vendor updaters or browser agents, running binaries from %APPDATA% | SmokeLoader (Zscaler) | Event ID 4698; Sysmon Event ID 1 |
| Executables and plugin files with SYSTEM and HIDDEN attributes in %APPDATA% | SmokeLoader (Zscaler) | EDR file events; Sysmon Event ID 11 |
| Unbacked executable memory in explorer.exe | SmokeLoader (Zscaler) | EDR memory scans; memory forensics |
| Startup folder location changed to the malware's directory; Run key edits | Amadey (MITRE) | Sysmon Event IDs 12 and 13 |
| Zone.Identifier stream reset on a downloaded file | Amadey (MITRE) | Sysmon Event ID 15 |
| Amcache entries or leftover install folders after a clean-up | SmokeLoader (Zscaler) | Forensic triage |
Prevention controls
- Application control: block execution from user-writable paths such as %APPDATA% and %TEMP%. See the Application Control and Endpoint Prevention Buyer's Guide.
- Script handlers: associate .js, .vbs and .wsf with Notepad, and constrain PowerShell for standard users.
- Software sources: block cracked software and unmanaged installers; deliver software from an internal catalogue.
- Egress: force web traffic through a proxy, block newly registered and uncategorised domains, and use protective DNS.
- Browser secrets: disable browser password saving through policy and use an enterprise password manager.
Rollout order
- Deploy the host hunts above in audit mode across a pilot ring and tune out legitimate updater tasks.
- Turn on application control for user-writable paths in audit mode, review a fortnight of events, then enforce.
- Add egress and protective DNS blocks, with a documented allow-list path for false positives.
- Roll back by ring if business tools break; keep detections on while enforcement is paused.
Metrics
- Time from loader alert to host isolation (target under one hour).
- Share of loader alerts where secret rotation finished within 24 hours.
- Percentage of endpoints with application control enforced on user-writable paths.
- Count of executions from %APPDATA% blocked per month, trending down as sources are removed.
- Repeat infections on the same host or user within 90 days.
Response steps
- Isolate the host and capture memory before reboot, because SmokeLoader's injected code lives in explorer.exe.
- Scope follow-on payloads: check for infostealers and remote access tools delivered after the loader.
- Revoke and rotate: user sessions, saved passwords, tokens, API keys and SSH keys readable from the host.
- Remove persistence: tasks, Run keys, Startup changes and hidden files; reimage where follow-on payloads ran.
- Find the entry point: phishing archive, cracked installer or fake update, and block it for everyone.
Common failure patterns
- Cleaning the loader and missing the buyers: the payloads sold through the install are the real incident.
- Reimaging without rotating secrets: stolen credentials and tokens stay valid after the host is clean.
- Allow-listing code hosting wholesale: the Talos case used GitHub to bypass filters.
- Relying on indicator feeds: rebuilds rotate C2 servers; hunt on behaviour and persistence.
- Assuming a takedown fixed it: Endgame removed infrastructure, not every residue on your hosts.
Practitioner checklist
- Hunt for updater-named scheduled tasks running from %APPDATA%.
- Alert on hidden, system-attributed executables in user profiles.
- Monitor Startup folder and Run key changes, and Zone.Identifier resets.
- Enforce application control on user-writable paths.
- Block cracked software sources and unmanaged installers.
- Route egress through a proxy with protective DNS.
- Include secret and token rotation in the loader playbook.
- Capture memory before reboot on suspected SmokeLoader hosts.
Standards and references
- MITRE ATT&CK: Smoke Loader (S0226)
- MITRE ATT&CK: Amadey (S1025)
- Europol: Largest ever operation against botnets hits dropper malware ecosystem
- Europol: Operation Endgame follow-up leads to five detentions
- Zscaler ThreatLabz: Operation Endgame, Smoke
- ESET Research: Operation Endgame disrupts Amadey and StealC
- Cisco Talos: MaaS operation using Emmenhtal and Amadey
Related NHI Mgmt Group resources: Malware Loaders and Droppers Guide · IcedID and Pikabot Loaders Guide · Malware-as-a-Service (MaaS) Economy Guide · StealC Infostealer Guide · Lumma Stealer Guide