Piracy Sites Spread SilentCryptoMiner Variant and RAT via Fake Video Player Updates

Researchers reported a malware campaign delivering a modified SilentCryptoMiner alongside a remote access trojan through illegal movie, TV, and digital library websites that pushed fake video player plugin updates. The infection chain used a ZIP archive containing a legitimate executable and a malicious DLL for DLL side-loading, then triggered stack-overflow-based ROP decryption and reflective loading to deploy the main module, a watchdog component, the RAT, and CPU/GPU miners.

The activity appears to extend operations seen since at least 2022, with refreshed infrastructure and delivery sites but largely unchanged archive structure and execution logic. The malware used DNS tunneling and date-based domain generation for execution gating and command-and-control, disabled security and power-saving features when it gained elevated privileges, and established persistence through a fake GoogleUpdateTaskMachineQC service; researchers said the campaign had substantial exposure because the affected piracy-related sites drew roughly 40 million visits in April 2026.