Loading story…
Aryaka Threat Research Labs reported a multi-stage CRPx0 malware campaign that tricks users searching for “free OnlyFans accounts” into opening a malicious ZIP archive containing a disguised shortcut. The shortcut launches hidden commands and a VBScript loader that prepares the host, installs components for Python-based malware, and connects to a remote server for interactive attacker control. Researchers said the operation targets Windows and macOS, with possible Linux support in development, and is built to blend into normal user behavior rather than rely on a single obvious malicious action.
Once active, the malware supports clipboard-based cryptocurrency theft, credential and data harvesting, system reconnaissance, selective exfiltration, and eventual ransomware deployment in a double-extortion scheme. Stolen content reportedly includes documents, media, emails, and source code before files are encrypted with the .crpx0 extension; the malware then changes the desktop wallpaper to a “gotcha” image and drops multilingual ransom notes directing victims to contact the operators via email, qTox, and Telegram. Reporting also said the group runs a leak site claiming 38 victims and more than 10,839 TB of leaked data, while offering access to stolen information for $500 in cryptocurrency.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
The operators maintained a leak site claiming 38 victims and more than 10,839 terabytes of leaked data, and reportedly offered access to stolen data for $500 in cryptocurrency. Victims were instructed to contact the attackers via email, qTox, and Telegram.
Aryaka Threat Research Labs publicly reported the multi-stage CRPx0 campaign and detailed how the lure, loaders, Python malware, data theft, and ransomware stages worked. The report emphasized the campaign's layered, adaptive behavior and the organizational risk posed by personal browsing activity.
After execution, the infection chain used hidden commands, a VBScript loader, and Python-based malware to establish remote control, perform reconnaissance, steal credentials and data, hijack cryptocurrency clipboard activity, and exfiltrate files. The attackers then deployed CRPx0 ransomware, encrypted files with the .crpx0 extension, changed the wallpaper, and dropped multilingual ransom notes as part of a double-extortion scheme.
Threat actors began distributing a multi-stage malware campaign using lures for "free OnlyFans accounts" to trick users into downloading a malicious ZIP archive containing a disguised shortcut file. The campaign targeted Windows and macOS systems, with possible Linux support reportedly under development.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **CRPx0** cybercrime operation has expanded from a scam service into a ransomware-as-a-service, cryptocurrency-theft, and white-label intrusion platform. Affiliates use ClickFix social-engineering pages impersonating Windows or macOS updates and Google reCAPTCHA to persuade targets to run malicious commands. On Windows, the reported chain uses clipboard-delivered PowerShell, encrypted DLL loaders, and a Python bootstrap; macOS victims may receive a portable Python environment and the ransomware payload directly. CRPx0 steals high-value data before encryption, attempts lateral movement, disables security controls, deletes backups, establishes persistence, and encrypts files with the `.crpx0` extension. Victims reportedly receive 48 hours to pay before stolen data is threatened with publication. The operation uses a clearnet PHP relay to proxy communications to Tor infrastructure and claims 47 victims, mainly in the United States and Turkey. Defenders should restrict ClickFix-prone execution paths, investigate suspicious `RunMRU` entries and pre-encryption exfiltration, block validated network indicators, and ensure backups cannot be accessed using compromised credentials.
Aug 28, 2026
Researchers found an open directory and management panel tied to the **CRPX0** malware operation at `fanonlyatn[.]xyz`, exposing the full source code, backend infrastructure, and operator details for a malware-as-a-service platform. The leaked materials showed a three-part criminal toolkit: a cryptocurrency clipboard hijacker supporting 10 coins, a **BIP39** seed-phrase scanner and stealer, and ransomware for **Windows, macOS, and Linux** that appends the `.crpx0` extension. The code and panel also exposed plaintext secrets, including a shared dashboard API secret, a loader password, ten hardcoded wallet addresses, and contact points linked to the operator, including the Telegram handle **@DataBreachPlus**, `databreachplus@proton[.]me`, and a qTox ID. Analysis of the leaked infrastructure tied the operation to backup command-and-control and ransom-notification domains hosted on `31[.]31[.]198[.]206` through **REG.RU**, while the primary panel sat behind Cloudflare. The exposed files showed Windows routines to delete Volume Shadow Copies, macOS builder scripts aimed at bypassing Gatekeeper, and lures themed around fake **FedEx** shipping notices and fake **OnlyFans** account lists. Researchers also identified a separate exposed **TwizAdmin** panel at `103.241.66[.]238:1337` that pointed to additional infostealer functionality and suggested the campaign has been active since at least July 2025; one unusual artifact was ransomware wallpaper containing **C2PA** metadata indicating it had been generated with **ChatGPT/GPT-4**.
Jun 29, 2026
A Vietnamese-speaking cybercriminal operation is distributing the Python-based **PXA Stealer** through phishing ZIP archives disguised as documents. The archives use hidden and system file attributes to obscure their contents and include renamed, legitimately signed executables—including Microsoft Word 2013, `winword.exe`, Haihaisoft PDF Reader, and WinRAR—used to DLL-side-load malicious payloads. In one execution chain, a renamed Microsoft-signed `winword.exe` loads a malicious `AppvIsvSubsystems64.dll`, which reconstructs a subsequent command from a padded Korean-named document; a WinRAR binary masquerading as a PNG then extracts further components. The operators also stage a signed Python interpreter as `C:\Users\Public\Windows\svchost.exe` and use obfuscated Python code to hinder detection and sandbox analysis. PXA Stealer collects browser passwords, cookies, autofill and payment-card data, authentication tokens, cryptocurrency-wallet information, and other application data. Stolen data is routed through Cloudflare Workers and related intermediary infrastructure to Telegram bots and channels, supporting a broader Telegram-based criminal ecosystem associated with Sherlock-related services that resell and reuse compromised information. Researchers identified more than 4,000 victim IP addresses in 62 countries, with South Korea, the United States, the Netherlands, Hungary, and Austria among the most affected; Cloudflare was notified and disrupted reported malicious Worker infrastructure.
Sep 25, 2026