Loading story…
Kaspersky researchers reported that the RedLine information-stealing malware was distributed through YouTube videos advertising game cheats, cracks, and similar illicit tools. The campaign used links in video descriptions and promoted downloads that appeared to offer gaming-related software, but instead delivered malware designed to harvest credentials, browser data, and other sensitive information from infected systems.
The activity showed how attackers targeted gamers by abusing trusted social platforms and interest in pirated or unauthorized software to drive infections at scale. By pairing social engineering with self-propagating distribution tactics, the operators expanded RedLine's reach and increased the risk of account theft, financial fraud, and broader compromise for users who downloaded the fake tools.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Kaspersky reported a self-spreading RedLine stealer campaign targeting gamers through YouTube videos advertising game cheats and cracked software. The malware was distributed through links in video descriptions and used infected victims' accounts to continue propagating the scheme.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported continued **RedLine Stealer** activity across multiple delivery chains, including phishing sites, fake cryptocurrency tools, trojanized installers, malicious Office documents, and botnet-driven payload drops. Recent analysis showed a sample disguised as a fake Netflix checker decrypting an embedded payload, writing `%AppData%\winlogon.exe`, and contacting `siyatermi.duckdns[.]org:17044` over **SOAP/HTTP via Windows Communication Foundation**. Separate investigations tied RedLine delivery to AutoIt-based wrappers used on phishing pages impersonating a cryptocurrency exchange, YouTube lures for a fake Binance autobuy bot hosted on GitHub, and Excel exploit chains abusing `CVE-2017-11882` to fetch and inject the stealer.
Aug 15, 2026
Threat actors have been using fake crack, keygen, pirated software, and bogus installer sites to infect users with information-stealing malware, often through SEO poisoning, redirect chains, and password-protected archives hosted on legitimate services such as MediaFire, Discord, and filesend.jp. Reported payloads include **RedLine**, **RecordBreaker**, **Cryptbot**, **CopperStealer**, **Lightning Stealer**, **FFDroider**, **ZingoStealer**, **LUMMASTEALER**, and **IDATLOADER**, with lures ranging from KMSpico activators and fake Telegram installers to cracked copies of TeamViewer, VueScan Pro, Movavi Video Editor, and other popular software. Several campaigns used anti-analysis techniques such as anti-VM checks, obfuscated loaders, process hollowing, DLL sideloading, and in-memory execution to evade detection. The malware families stole browser credentials, cookies, credit card data, Discord tokens, Telegram data, screenshots, desktop files, and cryptocurrency wallet information, while some also hijacked clipboard wallet addresses, redirected exchange traffic through malicious proxy settings, abused stolen Facebook and Instagram business accounts, or downloaded follow-on payloads such as miners and additional stealers. Researchers warned that these infections are often opportunistic because victims actively seek pirated software, but the resulting foothold can enable broader compromise, including persistence, backdoor access, VPN abuse, lateral movement, and resale of access to other criminals or ransomware operators.
Aug 15, 2026
Threat researchers reported multiple **COVID-19-themed phishing campaigns** distributing the **RedLine Stealer** malware by disguising payloads as legitimate pandemic-related software and information. In one campaign, attackers used an `Omicron Stats.exe` lure tied to the Omicron outbreak; in another, they impersonated a coronavirus research effort and pushed a fake **Folding@home** application named `foldingathomeapp.exe`. Researchers assessed email as the likely delivery vector, with the campaigns exploiting public anxiety and curiosity around the pandemic to drive downloads. Once executed, RedLine harvested **browser credentials, cookies, credit card and autocomplete data, cryptocurrency wallet artifacts, Telegram and Discord data, and detailed host information**. Fortinet said the Omicron-themed sample copied itself into the victim’s roaming `AppData` directory, established persistence through a scheduled task, and communicated with a command-and-control server at `207.32.217.89:14588` using a distinctive authorization header; Proofpoint and BleepingComputer also noted RedLine receives remote tasking after infection. Victims were observed across at least **12 countries**, indicating broad opportunistic targeting rather than a narrowly focused operation.
Aug 15, 2026