Undocumented Lua-wrapped loader drives BoldTealLayer malware campaign
A detailed blog post reveals BoldTealLayer’s multi‑stage attack chain, featuring a legitimate signed host that side‑loads a malicious DLL which launches a Lua engine to bypass Windows defenses and inject a .NET payload. The author provides IOCs, YARA rules, and mitigation guidance.