Loading story…
Sophos reported that a broad dropper-as-a-service operation used SEO-poisoned websites posing as sources for cracked software to deliver malware at scale. The infrastructure was tied to a 2021 Raccoon Stealer campaign but was also used to distribute multiple payloads, including CryptBot, Glupteba, click-fraud malware, cryptocurrency miners, and ransomware such as Conti and STOP. Operators also monetized untargeted visitors through fake alerts, malicious browser extensions, and affiliate redirects, turning pirated-software searches into a multi-purpose criminal revenue stream.
Researchers linked parts of the ecosystem to the InstallUSD advertising network in Pakistan and to Russian-language install services including InstallBest, highlighting an underground market where criminals can buy geographically targeted malware installs. The delivery chain relied on layered redirects, referral proxies, Cloudflare-fronted trackers, short-lived Amazon EC2 download servers, and password-protected archives to evade inspection and security controls. Sophos said one InstallUSD-linked landing host was disrupted after being reported to Cloudflare, but the operators rapidly shifted to modified infrastructure, underscoring the resilience of paid-download malware networks and the risk they pose to organizations when users seek pirated business or consumer software on personal or shared devices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Sophos disrupted one landing host associated with InstallUSD by reporting it to Cloudflare. The operators then shifted to modified infrastructure, showing the resilience of the delivery network.
Researchers linked part of the infrastructure to the InstallUSD advertising network in Pakistan and to Russian-language install services such as InstallBest, highlighting an underground paid-download market for geographically targeted malware installs.
The investigation found the same infrastructure was used to distribute multiple malware families, including Raccoon Stealer, CryptBot, Glupteba, click-fraud malware, cryptocurrency miners, and ransomware such as Conti and STOP. The operation also monetized non-target visitors through fake alerts, browser extensions, and affiliate redirects.
Sophos researchers examined a malware campaign involving Raccoon Stealer and determined it was part of a broader malware delivery operation using SEO-poisoned websites advertising cracked software.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are using **software impersonation** and **SEO poisoning** to push victims toward fake download sites for trusted enterprise and IT tools, then delivering malware through trojanized installers. In one campaign, **Storm-2561** used spoofed VPN vendor pages for products such as **Pulse Secure, Fortinet, and Ivanti** to steal enterprise VPN credentials. The malicious packages were hosted on GitHub, signed with a certificate issued to **"Taiyuan Lihua Near Information Technology Co., Ltd."**, and designed to show an error before redirecting victims to the legitimate vendor site, reducing suspicion while exfiltrating credentials. A separate but closely related campaign used fake **FileZilla** download pages to distribute a **Remote Access Trojan** through multi-stage loaders and **DLL sideloading**. Attackers bundled legitimate FileZilla software with a malicious `version.dll`, or dropped the DLL during installation so the malware would execute while the expected application appeared to install normally. Both reports describe the same broader intrusion pattern: adversaries abusing trusted brands, realistic lookalike websites, and legitimate software packaging to compromise users who believe they are downloading authentic tools. A separate **Warlock** intrusion analysis describing web shells, lateral movement, tunneling, and ransomware activity is a different incident and does not match this malware-delivery story.
Jun 29, 2026
Researchers reported multiple campaigns using fake download and streaming sites to compromise users with remote access tools, malware, and proxyware. Kaspersky found more than 90 spoofed domains in 10 languages promoting bogus Windows software downloads through search engine optimization; the delivered archives used DLL sideloading to install the expected application alongside **ScreenConnect**, then deployed **AsyncRAT** for persistent access. In one investigated case, the attackers altered Microsoft Defender exclusions, disabled User Account Control, and used process hollowing into `RegAsm.exe` to launch the payload, creating risk for both consumers and enterprise networks because remote administration tools are often allowlisted and may run with elevated privileges. A parallel set of campaigns abused demand for free media and utilities to lure victims into installing unwanted software that can expose systems and internet connections to criminal use. Researchers tracking World Cup-themed piracy sites found rotating mirror domains, typosquatting, and cloud-hosted pages pushing fake **Stremio** installers, VPN-themed lures, and affiliate-style downloads tied to malware, phishing, and scams. Separate analysis of a fake **7-Zip** installer showed a Go-based backdoor that converted infected Windows hosts into residential proxy nodes, while broader threat reporting warned that free VPNs, streaming apps, browser extensions, and cheap IoT products are increasingly used to build residential proxy networks that criminals exploit for fraud, scraping, account abuse, and evasion.
Jul 12, 2026
A large-scale campaign has impersonated popular open-source and freeware projects, including **Ghidra**, **dnSpy**, and **SpiderFoot**, to capture search traffic and hijack software download clicks. Researchers found that the fake sites use CloudFront-hosted JavaScript to intercept a visitor’s first interaction and send users into a gated Traffic Distribution System (TDS) that performs anti-bot screening, VPN and datacenter filtering, click confirmation, and frequency capping before deciding what content to serve. The infrastructure appears primarily built for traffic acquisition and monetization, but selected victims were repeatedly routed into malware delivery chains. Those chains included **SessionGate**, a heavily obfuscated multi-stage framework with strong anti-analysis protections that mainly delivered potentially unwanted applications, as well as **RemusStealer** and **AnimateClipper**, which were used to deploy an infostealer and a cryptocurrency clipper. Researchers said the operation has been active since at least late 2025, with active malware distribution observed from early 2026 and more than **5,000** VirusTotal submissions indicating significant scale.
Jun 29, 2026