HELPLOADERHelpLoader

HelpLoader is the loader component that delivers SpiceRAT, named by Cisco Talos in June 2024. It is sideloaded by a renamed legitimate executable and is responsible for decrypting and running the implant, which never touches disk in its final form. Reported in campaigns attributed to SneakyChef, and observed again in August 2026 by Bitdefender within the SilkParasite activity cluster.