Loading story…
Sophos reported that a broad dropper-as-a-service operation used SEO-poisoned websites posing as sources for cracked software to deliver malware at scale. The infrastructure was tied to a 2021 Raccoon Stealer campaign but was also used to distribute multiple payloads, including CryptBot, Glupteba, click-fraud malware, cryptocurrency miners, and ransomware such as Conti and STOP. Operators also monetized untargeted visitors through fake alerts, malicious browser extensions, and affiliate redirects, turning pirated-software searches into a multi-purpose criminal revenue stream.
Researchers linked parts of the ecosystem to the InstallUSD advertising network in Pakistan and to Russian-language install services including InstallBest, highlighting an underground market where criminals can buy geographically targeted malware installs. The delivery chain relied on layered redirects, referral proxies, Cloudflare-fronted trackers, short-lived Amazon EC2 download servers, and password-protected archives to evade inspection and security controls. Sophos said one InstallUSD-linked landing host was disrupted after being reported to Cloudflare, but the operators rapidly shifted to modified infrastructure, underscoring the resilience of paid-download malware networks and the risk they pose to organizations when users seek pirated business or consumer software on personal or shared devices.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Sophos disrupted one landing host associated with InstallUSD by reporting it to Cloudflare. The operators then shifted to modified infrastructure, showing the resilience of the delivery network.
Researchers linked part of the infrastructure to the InstallUSD advertising network in Pakistan and to Russian-language install services such as InstallBest, highlighting an underground paid-download market for geographically targeted malware installs.
The investigation found the same infrastructure was used to distribute multiple malware families, including Raccoon Stealer, CryptBot, Glupteba, click-fraud malware, cryptocurrency miners, and ransomware such as Conti and STOP. The operation also monetized non-target visitors through fake alerts, browser extensions, and affiliate redirects.
Sophos researchers examined a malware campaign involving Raccoon Stealer and determined it was part of a broader malware delivery operation using SEO-poisoned websites advertising cracked software.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors have been using fake crack, keygen, pirated software, and bogus installer sites to infect users with information-stealing malware, often through SEO poisoning, redirect chains, and password-protected archives hosted on legitimate services such as MediaFire, Discord, and filesend.jp. Reported payloads include **RedLine**, **RecordBreaker**, **Cryptbot**, **CopperStealer**, **Lightning Stealer**, **FFDroider**, **ZingoStealer**, **LUMMASTEALER**, and **IDATLOADER**, with lures ranging from KMSpico activators and fake Telegram installers to cracked copies of TeamViewer, VueScan Pro, Movavi Video Editor, and other popular software. Several campaigns used anti-analysis techniques such as anti-VM checks, obfuscated loaders, process hollowing, DLL sideloading, and in-memory execution to evade detection. The malware families stole browser credentials, cookies, credit card data, Discord tokens, Telegram data, screenshots, desktop files, and cryptocurrency wallet information, while some also hijacked clipboard wallet addresses, redirected exchange traffic through malicious proxy settings, abused stolen Facebook and Instagram business accounts, or downloaded follow-on payloads such as miners and additional stealers. Researchers warned that these infections are often opportunistic because victims actively seek pirated software, but the resulting foothold can enable broader compromise, including persistence, backdoor access, VPN abuse, lateral movement, and resale of access to other criminals or ransomware operators.
Aug 15, 2026
Threat actors are using **software impersonation** and **SEO poisoning** to push victims toward fake download sites for trusted enterprise and IT tools, then delivering malware through trojanized installers. In one campaign, **Storm-2561** used spoofed VPN vendor pages for products such as **Pulse Secure, Fortinet, and Ivanti** to steal enterprise VPN credentials. The malicious packages were hosted on GitHub, signed with a certificate issued to **"Taiyuan Lihua Near Information Technology Co., Ltd."**, and designed to show an error before redirecting victims to the legitimate vendor site, reducing suspicion while exfiltrating credentials. A separate but closely related campaign used fake **FileZilla** download pages to distribute a **Remote Access Trojan** through multi-stage loaders and **DLL sideloading**. Attackers bundled legitimate FileZilla software with a malicious `version.dll`, or dropped the DLL during installation so the malware would execute while the expected application appeared to install normally. Both reports describe the same broader intrusion pattern: adversaries abusing trusted brands, realistic lookalike websites, and legitimate software packaging to compromise users who believe they are downloading authentic tools. A separate **Warlock** intrusion analysis describing web shells, lateral movement, tunneling, and ransomware activity is a different incident and does not match this malware-delivery story.
Jun 29, 2026
Researchers reported multiple campaigns using fake download and streaming sites to compromise users with remote access tools, malware, and proxyware. Kaspersky found more than 90 spoofed domains in 10 languages promoting bogus Windows software downloads through search engine optimization; the delivered archives used DLL sideloading to install the expected application alongside **ScreenConnect**, then deployed **AsyncRAT** for persistent access. In one investigated case, the attackers altered Microsoft Defender exclusions, disabled User Account Control, and used process hollowing into `RegAsm.exe` to launch the payload, creating risk for both consumers and enterprise networks because remote administration tools are often allowlisted and may run with elevated privileges. A parallel set of campaigns abused demand for free media and utilities to lure victims into installing unwanted software that can expose systems and internet connections to criminal use. Researchers tracking World Cup-themed piracy sites found rotating mirror domains, typosquatting, and cloud-hosted pages pushing fake **Stremio** installers, VPN-themed lures, and affiliate-style downloads tied to malware, phishing, and scams. Separate analysis of a fake **7-Zip** installer showed a Go-based backdoor that converted infected Windows hosts into residential proxy nodes, while broader threat reporting warned that free VPNs, streaming apps, browser extensions, and cheap IoT products are increasingly used to build residential proxy networks that criminals exploit for fraud, scraping, account abuse, and evasion.
Jul 12, 2026