Trojan.ChimeraWire
Trojan.ChimeraWire is a trojan reported by Dr.Web in December 2025 that artificially increases the popularity of websites while evading anti-bot protections by pretending to be a human user. According to the provided reporting, it searches for target sites through search engines including Google and Bing, opens those sites, and performs clicks based on parameters supplied by the threat actor. Dr.Web stated that the malware infects computers via multiple malicious programs that exploit DLL Search Order Hijacking class vulnerabilities, and that it uses anti-debugging techniques. The available content does not attribute Trojan.ChimeraWire to a specific threat actor or identify specific targeted industries. No concrete indicators of compromise are provided in the source content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Automated web traffic/click fraud trojan that searches for target sites via Google/Bing, opens them, and clicks pages per attacker tasks while emulating human behavior to evade anti-bot protections; installed by other malware exploiting DLL Search Order Hijacking class vulnerabilities.
Automated web-traffic/click-fraud trojan that searches for target sites via Google/Bing, opens them, and performs instructed clicks while emulating human behavior to evade anti-bot controls; delivered by other malware leveraging DLL Search Order Hijacking-class weaknesses.
Click-fraud/traffic-manipulation trojan that simulates human browsing to evade anti-bot protections; searches for target sites via search engines, opens them, and performs clicks per attacker-supplied parameters; uses DLL Search Order Hijacking-class weaknesses for infection and anti-debugging to hinder analysis/detection.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.