Netskope Threat Labs

Loki

ATP Sandbox Adv. HeuristicsAV

Description

Loki is an information stealer and keylogger that harvests saved passwords, browser data, and application credentials from infected systems. It has circulated in criminal markets for years, and its operators bundle it with loaders and fake software to collect data at scale. Detections under this name indicate that an implant captured authentication material, which should trigger credential resets for affected accounts.

Stats

First seen
March 2022
Last seen
October 2026

Also known as

loki

Alert name variants

Alert Name
Android.Trojan.Loki
ByteCode-MSIL.Ransomware.Loki
Document-Word.Trojan.Loki
Dropped:Trojan.Ransom.Loki.CSB
Dropped:Trojan.Ransom.Loki.DEM
Dropped:Trojan.Ransom.Loki.GGA
Gen:Variant.Ransom.Loki.10112
Gen:Variant.Ransom.Loki.10293
Gen:Variant.Ransom.Loki.10302
Gen:Variant.Ransom.Loki.1033

Related blogs

Related families

LokibotAzorultRyukTrickBot

References