Loading story…
Threat researchers reported two large malware distribution operations that relied on popular consumer lures rather than software exploits. One campaign used piracy sites offering movies, TV shows, books, and digital library content to push fake plugin or browser update prompts; the downloaded ZIP files abused DLL side-loading, ROP-based decryption, and reflective loading to install a modified SilentCryptoMiner, a watchdog, a RAT component, and CPU/GPU miners. The malware gated execution through DNS tunneling and date-generated command-and-control infrastructure, harvested host data, and established persistence with a fake GoogleUpdateTaskMachineQC service and repeated UAC elevation attempts, with implicated sites drawing roughly 40 million visits in a single month.
A separate operation used openew[.]app, a fake ChatGPT download page impersonating OpenAI, to infect both Windows and macOS users with platform-specific malware. Windows visitors received a credential-stealing loader disguised as Chat_GPT.exe, built with Inno Setup and Electron and launching PowerShell activity that contacted 188.137.246.189, while macOS users were served Atomic Stealer (AMOS) to steal passwords, browser data, Telegram sessions, and cryptocurrency wallet information. Researchers said the macOS payload also attempted to replace legitimate Ledger and Trezor applications with trojanized versions, underscoring a strong cryptocurrency theft motive and showing how attackers are exploiting AI-brand search traffic and piracy demand to scale malware infections.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A fake site, openew[.]app, impersonated OpenAI’s ChatGPT download page and served different malware by platform: a credential-stealing loader to Windows users and Atomic Stealer (AMOS) to macOS users. The macOS payload also attempted to replace Ledger and Trezor wallet apps with trojanized versions.
In late April 2026, responders investigated a campaign in which piracy-related websites used fake plugin or browser update prompts to deliver a ZIP archive that deployed a modified SilentCryptoMiner-based payload, RAT components, and CPU/GPU miners.
The malware campaign tied to illegal movie, TV, and pirated digital library websites appears to date back to at least 2022, indicating a long-running operation targeting piracy users with malware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemalwarebytes.com
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported two malware campaigns that install cryptocurrency miners through trojanized downloads delivered from pirate streaming sites and fake software portals. In one operation, users visiting illicit movie and TV sites were shown a bogus video-plugin update that delivered a ZIP archive containing a legitimate executable and a malicious DLL; the DLL sideloaded a multi-stage miner framework with persistence, defense evasion, a watchdog, a **RAT** component, and CPU/GPU mining modules. The malware, a modified fork of SilentCryptoMiner, used DNS tunneling for execution gating, installed a service named `GoogleUpdateTaskMachineQC`, weakened Windows defenses, injected into `conhost.exe` and `explorer.exe`, and communicated through rotating domains and infrastructure tied to `107[.]172[.]212[.]235`. Microsoft described a related cryptojacking-focused campaign aimed at owners of high-performance PCs, using fake downloads of popular utilities and hardware-monitoring tools that were promoted through SEO poisoning and, more recently, surfaced in AI assistant recommendations. Those ZIP archives also paired a legitimate executable with a malicious DLL for sideloading, then installed **ScreenConnect** for persistent remote access, set registry autoruns and scheduled tasks, added Microsoft Defender exclusions, checked for analysis tools, and used process hollowing to launch payloads inside trusted Windows processes. After profiling infected systems, the attackers fetched GPU miners including **gminer**, **lolMiner**, and **SRBMiner-MULTI**; researchers warned the access could support not only cryptomining but also data theft, lateral movement, and eventual ransomware deployment.
Jun 29, 2026
Researchers documented several malware campaigns that used fake software and trojanized packages to deliver credential theft and remote-access payloads. On Windows, a fake *Resident Evil 9* mod from GitHub triggered a `curl | cmd` chain that deployed hidden batch, JavaScript, portable Node.js, portable Python, and an in-memory Go payload with browser theft, wallet targeting, hVNC-style control, webcam-related code, and exfiltration via Wormhole/B2 and Gofile; a separate fake AI video player installer led through Python bytecode, shellcode, and protected .NET loaders to **PureRAT**, which persisted through the `Run` key and communicated over authenticated WebSockets with `agent.sm-veo.com`. Another Windows campaign, dubbed **Operation TURB00**, used a Go loader and decoy console program to launch **Vidar** in memory, steal browser and application data, and install persistence through `agt.dll` and the `CadenceOptimizer` service running under `svchost` as `LocalSystem`. On macOS, analysts reversed a fully undetected **Atomic macOS Stealer (AMOS)** sample distributed as a signed DMG, bypassed its anti-VM checks, and recovered an AppleScript payload that stole browser data, wallet files, Telegram Desktop data, documents, and system information before exfiltrating to `95.164.53.3/contact`. In the software supply chain, a malicious PyPI package, `nhmpy 2.4.7`, masqueraded as NumPy while using a `.pth` file and an obfuscated JavaScript payload executed through Bun to harvest developer, cloud, CI/CD, registry, SSH, wallet, messaging, VPN, and AI-assistant secrets; it then spread using stolen GitHub tokens and malicious GitHub Actions workflows. Separately, a public Windows local privilege escalation exploit named **REDSUN** showed how attackers could turn standard-user access into `NT AUTHORITY\SYSTEM` by abusing a TOCTOU flaw involving NTFS and the Cloud Files API, creating a potential post-compromise path for malware already running on a host.
Jul 12, 2026
Researchers reported a malware campaign delivering a modified **SilentCryptoMiner** alongside a remote access trojan through illegal movie, TV, and digital library websites that pushed fake video player plugin updates. The infection chain used a ZIP archive containing a legitimate executable and a malicious DLL for **DLL side-loading**, then triggered stack-overflow-based ROP decryption and reflective loading to deploy the main module, a watchdog component, the RAT, and CPU/GPU miners. The activity appears to extend operations seen since at least 2022, with refreshed infrastructure and delivery sites but largely unchanged archive structure and execution logic. The malware used **DNS tunneling** and date-based domain generation for execution gating and command-and-control, disabled security and power-saving features when it gained elevated privileges, and established persistence through a fake `GoogleUpdateTaskMachineQC` service; researchers said the campaign had substantial exposure because the affected piracy-related sites drew roughly **40 million visits** in April 2026.
Jun 29, 2026