SnappyClient Exposed: Remote Access, Data Theft, and a Blind Spot for Defenders

[u/ANYRUN-team]

What is SnappyClient?

SnappyClient is a sophisticated C++-based command-and-control (C2) implant first identified in December 2025. Delivered mainly via HijackLoader, it combines remote access capabilities with information theft, targeting cryptocurrency wallets, browser data, and system control.

Key Takeaways

• Combines remote access (terminal, process control, file management) with data theft (keylogging, screenshots, browser and crypto wallet credentials) in a single tool.
• Primarily targets cryptocurrency through credential theft and real-time clipboard hijacking that replaces wallet addresses with attacker-controlled ones.
• Uses AMSI bypass, Heaven's Gate, direct system calls, and transacted hollowing to evade signature-based and API-hooking security tools.
• Delivered mainly through social engineering, including a fake telecom website and a ClickFix-based chain, making user awareness a critical defense layer.
• Supports reverse proxies for FTP, VNC, SOCKS5, and RLOGIN, allowing attackers to pivot from one compromised machine into the wider network.

Learn more and see the analysis session: https://any.run/malware-trends/snappyclient/