Spoofed GlobalProtect Used to DeliverUnique WikiLoader Variant

## Executive Summary Unit 42 describes an active WikiLoader (WailingCrab) campaign that used SEO poisoning and spoofed GlobalProtect download pages to deliver a multi-stage Windows loader. The campaign abuses renamed legitimate binaries and DLL sideloading, decrypts and injects shellcode into explorer.exe, leverages WordPress sites and MQTT brokers for C2, and employs multiple anti-analysis and evasion techniques; the report includes comprehensive technical analysis, IOCs (URLs and SHA-256 hashes), and XQL hunting queries for detection.