Netskope Threat Labs

Oysterloader

ATP Sandbox Adv. HeuristicsNetskope IPS

OysterLoader is a loader family that researchers tracked throughout 2024 in distribution campaigns that used malicious Chrome browser extensions and malvertising. It maintains persistence on Windows systems and delivers heavier payloads such as information stealers, and its operators refresh the code regularly to defeat detection.

First seen
June 2024
Last seen
September 2026
OysterLoader
Alert Name
Win32.Trojan.Oysterloader
Win32.Trojan.OysterLoader
Win64.Trojan.Oysterloader
Win64.Trojan.OysterLoader