Cryptojacking Campaign Uses AI Chatbot Recommendations and SEO Poisoning

Microsoft reported an active cryptojacking campaign that uses poisoned search results and, in some cases, AI chatbot software recommendations to steer users to attacker-controlled sites impersonating popular utilities including CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec Pack, and PDFgear. The operation appears to target hardware enthusiasts and other users with high-performance GPUs, delivering ZIP archives that bundle legitimate applications with malicious autorun.dll files for DLL sideloading. Microsoft said it has identified more than 150 malicious domains tied to the campaign since March 2026.

After execution, the malware abuses ScreenConnect for persistent remote access, uses a custom loader with process hollowing into Microsoft-signed .NET binaries, adds Microsoft Defender exclusions, and performs anti-analysis and host reconnaissance before downloading miners such as gminer, lolMiner, and SRBMiner-MULTI. The malware can pause mining during user or GPU activity to reduce detection, and Microsoft warned that the ScreenConnect foothold could also support follow-on actions including data theft, lateral movement, or ransomware. Microsoft said Defender detected and blocked related activity and highlighted mitigations including cloud-delivered protection, EDR in block mode, network and web protection, SmartScreen, and attack surface reduction rules.