OysterLoader Scheduled Task and Rundll32 from AppData

Daniel Jeremiah@daniyyell

•updated Feb 22, 2026•1•0•25

OysterLoader stage 3 creates a scheduled task (every 13 min) running rundll32 with a DLL from AppData. Task names include COPYING3, VisualUpdater, AlphaSecurity, DetectorSpywareSecurity. Sekoia report.