Loading story…
Researchers reported two malware campaigns that install cryptocurrency miners through trojanized downloads delivered from pirate streaming sites and fake software portals. In one operation, users visiting illicit movie and TV sites were shown a bogus video-plugin update that delivered a ZIP archive containing a legitimate executable and a malicious DLL; the DLL sideloaded a multi-stage miner framework with persistence, defense evasion, a watchdog, a RAT component, and CPU/GPU mining modules. The malware, a modified fork of SilentCryptoMiner, used DNS tunneling for execution gating, installed a service named GoogleUpdateTaskMachineQC, weakened Windows defenses, injected into conhost.exe and explorer.exe, and communicated through rotating domains and infrastructure tied to 107[.]172[.]212[.]235.
Microsoft described a related cryptojacking-focused campaign aimed at owners of high-performance PCs, using fake downloads of popular utilities and hardware-monitoring tools that were promoted through SEO poisoning and, more recently, surfaced in AI assistant recommendations. Those ZIP archives also paired a legitimate executable with a malicious DLL for sideloading, then installed ScreenConnect for persistent remote access, set registry autoruns and scheduled tasks, added Microsoft Defender exclusions, checked for analysis tools, and used process hollowing to launch payloads inside trusted Windows processes. After profiling infected systems, the attackers fetched GPU miners including gminer, lolMiner, and SRBMiner-MULTI; researchers warned the access could support not only cryptomining but also data theft, lateral movement, and eventual ransomware deployment.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Xakep reported Microsoft's findings on the campaign that abuses fake software downloads and AI assistant recommendations to deliver malware and GPU miners to powerful PCs.
Microsoft researchers identified a malware campaign that lured owners of high-performance PCs with fake downloads of popular utilities and hardware monitoring tools. The malware used DLL sideloading, installed ScreenConnect for persistent remote access, established persistence and Defender exclusions, and then deployed GPU-focused cryptocurrency miners.
Microsoft researchers said that by spring 2026 they observed malicious domains from a cryptojacking campaign appearing in AI assistant responses when users asked where to download popular software. The campaign had previously relied on SEO poisoning before expanding to this delivery vector.
Kaspersky disclosed technical analysis of the pirate-site campaign, including its modified SilentCryptoMiner fork, DNS-tunneling execution gating, persistence via GoogleUpdateTaskMachineQC, RAT communications, hashes, detections, and C2 indicators.
Kaspersky reported that the infected pirate resources associated with the campaign collectively received about 40 million visits in April 2026, indicating potentially large exposure.
Researchers investigated an infection in late April 2026 in which users visiting pirate streaming sites were shown a fake video-plugin update prompt that delivered a ZIP archive containing a legitimate executable and a malicious DLL for sideloading. The resulting malware chain installed a multi-stage miner framework with persistence, defense evasion, a watchdog, a RAT component, and CPU/GPU mining modules.
Kaspersky said the miner campaign delivered via pirate movie and TV streaming resources appears to be a continuation of broader activity that has been active since at least 2022.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a malware campaign delivering a modified **SilentCryptoMiner** alongside a remote access trojan through illegal movie, TV, and digital library websites that pushed fake video player plugin updates. The infection chain used a ZIP archive containing a legitimate executable and a malicious DLL for **DLL side-loading**, then triggered stack-overflow-based ROP decryption and reflective loading to deploy the main module, a watchdog component, the RAT, and CPU/GPU miners. The activity appears to extend operations seen since at least 2022, with refreshed infrastructure and delivery sites but largely unchanged archive structure and execution logic. The malware used **DNS tunneling** and date-based domain generation for execution gating and command-and-control, disabled security and power-saving features when it gained elevated privileges, and established persistence through a fake `GoogleUpdateTaskMachineQC` service; researchers said the campaign had substantial exposure because the affected piracy-related sites drew roughly **40 million visits** in April 2026.
Jun 29, 2026
Microsoft reported an active cryptojacking campaign that uses poisoned search results and, in some cases, AI chatbot software recommendations to steer users to attacker-controlled sites impersonating popular utilities including CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec Pack, and PDFgear. The operation appears to target hardware enthusiasts and other users with high-performance GPUs, delivering ZIP archives that bundle legitimate applications with malicious `autorun.dll` files for DLL sideloading. Microsoft said it has identified more than 150 malicious domains tied to the campaign since March 2026. After execution, the malware abuses ScreenConnect for persistent remote access, uses a custom loader with process hollowing into Microsoft-signed .NET binaries, adds Microsoft Defender exclusions, and performs anti-analysis and host reconnaissance before downloading miners such as `gminer`, `lolMiner`, and `SRBMiner-MULTI`. The malware can pause mining during user or GPU activity to reduce detection, and Microsoft warned that the ScreenConnect foothold could also support follow-on actions including data theft, lateral movement, or ransomware. Microsoft said Defender detected and blocked related activity and highlighted mitigations including cloud-delivered protection, EDR in block mode, network and web protection, SmartScreen, and attack surface reduction rules.
Jun 29, 2026
Threat researchers reported two large malware distribution operations that relied on popular consumer lures rather than software exploits. One campaign used piracy sites offering movies, TV shows, books, and digital library content to push fake plugin or browser update prompts; the downloaded ZIP files abused DLL side-loading, ROP-based decryption, and reflective loading to install a modified `SilentCryptoMiner`, a watchdog, a RAT component, and CPU/GPU miners. The malware gated execution through DNS tunneling and date-generated command-and-control infrastructure, harvested host data, and established persistence with a fake `GoogleUpdateTaskMachineQC` service and repeated UAC elevation attempts, with implicated sites drawing roughly 40 million visits in a single month. A separate operation used `openew[.]app`, a fake ChatGPT download page impersonating OpenAI, to infect both Windows and macOS users with platform-specific malware. Windows visitors received a credential-stealing loader disguised as `Chat_GPT.exe`, built with Inno Setup and Electron and launching PowerShell activity that contacted `188.137.246.189`, while macOS users were served **Atomic Stealer (AMOS)** to steal passwords, browser data, Telegram sessions, and cryptocurrency wallet information. Researchers said the macOS payload also attempted to replace legitimate Ledger and Trezor applications with trojanized versions, underscoring a strong cryptocurrency theft motive and showing how attackers are exploiting AI-brand search traffic and piracy demand to scale malware infections.
Jun 29, 2026