☕ CoffeeLoader – The New Malware That Uses Your GPU to Evade Antivirus

Raluca Gheorghita

In today’s fast-evolving digital landscape, where cyber attackers constantly innovate, security researchers are sounding the alarm about a new sophisticated threat: CoffeeLoader. Recently analyzed by Zscaler ThreatLabz, this malware is designed to download and execute secondary payloads while evading traditional antivirus and EDR (Endpoint Detection and Response) solutions.

🧠 What is CoffeeLoader?

Discovered in late 2024, CoffeeLoader is a next-generation malware loader with many behavioral similarities to the well-known SmokeLoader. Experts believe CoffeeLoader may represent the evolution—or even the successor—of that earlier threat.

“The purpose of this malware is to download and execute second-stage payloads while evading endpoint-based security products.” – Brett Stone-Gross, Zscaler

🛠 Advanced Evasion Techniques

CoffeeLoader comes equipped with a cutting-edge arsenal, including:

  • A GPU-based packer called Armoury, designed to execute code on the graphics card, making analysis in virtual environments extremely difficult.
  • Call stack spoofing to hide the true origin of code execution.
  • Sleep obfuscation, which masks malicious activity during idle states.
  • Use of Windows Fibers for advanced multitasking that is difficult for security tools to trace.

These techniques make CoffeeLoader highly evasive, even in environments with strong endpoint defenses.

⚙️ How Does the Infection Work?

The infection chain begins with a dropper that:

  1. Loads a malicious DLL (ArmouryAIOSDK.dll or ArmouryA.dll) with elevated privileges.
  2. Attempts to bypass UAC if it doesn’t already have admin access.
  3. Sets up a scheduled task that runs either every 10 minutes or at user logon with the highest privileges.
  4. Executes a stager component that loads the main module and connects to a command-and-control (C2) server via HTTPS.

Once connected, the system can receive additional payloads—such as injecting the Rhadamanthys shellcode.

🤝 CoffeeLoader vs SmokeLoader – A New Generation?

Zscaler has identified multiple code-level similarities between CoffeeLoader and SmokeLoader. In some cases, SmokeLoader was used to distribute CoffeeLoader, suggesting a possible lineage. While the exact relationship remains unclear, it appears CoffeeLoader could be a more advanced iteration, adapted for 2025’s security landscape.

🧩 Key Takeaways for Security Professionals

This case highlights the need for:

  • Advanced detection techniques, including behavioral analysis and GPU activity monitoring.
  • Modern EDR solutions with deeper visibility.
  • Regular penetration testing to proactively uncover and fix security gaps.

🔐 What Can Organizations Do?

💡 Penetration Testing – Simulating real-world attacks is crucial to identify vulnerabilities before attackers exploit them.

📊 Up-to-date Threat Intelligence – Staying informed about new threats like CoffeeLoader enables security teams to adapt defenses quickly.

👥 Employee Awareness – Training users on phishing tactics and the risks of using cracked software (as seen in recent TradingView scams via Reddit) is still a vital line of defense.

🔎 Final Thoughts

CoffeeLoader is a clear sign that attackers are not just innovating—they’re rewriting the rules. Leveraging GPU-based execution to hide malicious behavior marks a new era in evasion techniques. Now more than ever, organizations must reassess their current defenses and invest in proactive security strategies.

🔐 Looking to test your infrastructure against threats like CoffeeLoader? Our penetration testing services help you stay one step ahead of cybercriminals.

You should also read: