Cryptomining Malware Uses DLL Sideloading on Pirate Sites and Fake Utility Downloads

Researchers reported two malware campaigns that install cryptocurrency miners through trojanized downloads delivered from pirate streaming sites and fake software portals. In one operation, users visiting illicit movie and TV sites were shown a bogus video-plugin update that delivered a ZIP archive containing a legitimate executable and a malicious DLL; the DLL sideloaded a multi-stage miner framework with persistence, defense evasion, a watchdog, a RAT component, and CPU/GPU mining modules. The malware, a modified fork of SilentCryptoMiner, used DNS tunneling for execution gating, installed a service named GoogleUpdateTaskMachineQC, weakened Windows defenses, injected into conhost.exe and explorer.exe, and communicated through rotating domains and infrastructure tied to 107[.]172[.]212[.]235.

Microsoft described a related cryptojacking-focused campaign aimed at owners of high-performance PCs, using fake downloads of popular utilities and hardware-monitoring tools that were promoted through SEO poisoning and, more recently, surfaced in AI assistant recommendations. Those ZIP archives also paired a legitimate executable with a malicious DLL for sideloading, then installed ScreenConnect for persistent remote access, set registry autoruns and scheduled tasks, added Microsoft Defender exclusions, checked for analysis tools, and used process hollowing to launch payloads inside trusted Windows processes. After profiling infected systems, the attackers fetched GPU miners including gminer, lolMiner, and SRBMiner-MULTI; researchers warned the access could support not only cryptomining but also data theft, lateral movement, and eventual ransomware deployment.