Loading story…
Kaspersky reported a malware campaign that trojanized adult “hentai” games to install a previously unknown remote access trojan, Argamal, on Windows systems. The attackers distributed modified game files through dedicated adult-game websites, PixelDrain links, torrent trackers including AniRena, and fake cheat posts on gaming forums. The infection chain relied on DLL side-loading and PowerShell-based download stages, then established persistence by COM hijacking the Windows Color System Calibration Loader task before deploying the full RAT.
Argamal was described as a full-featured backdoor that used encrypted payloads hosted on GitHub, anti-analysis checks, and both UDP and TCP channels for command-and-control and payload updates. Kaspersky said the campaign had already infected hundreds of victims, with most cases observed in Russia, Brazil, Germany, and Vietnam, and noted that associated C2 domains largely resolved to 186.158.223.35. The company assessed with medium confidence that the developer behind the downloader chain is Spanish-speaking.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Kaspersky assessed with moderate confidence that the developers behind Argamal are Spanish-speaking, citing Spanish-language code comments, variable names, and website code. The report also noted the malware excluded Chinese-language systems from normal C2 routing.
Kaspersky described a malware campaign it discovered in April 2026 in which adult “hentai” games were trojanized to deliver a previously unknown malware family named Argamal. The campaign used modified game files, DLL side-loading, PowerShell download stages, COM hijacking for persistence, and GitHub-hosted encrypted payloads, with hundreds of victims reported across multiple countries.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 25 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcehackread.com
Open sourcesecurityonline.info
Open sourcexakep.ru
Open sourcemalware.news
Open sourcesecurelist.ru
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recent reporting highlights multiple **social-engineering-driven malware delivery** efforts that culminate in remote access and persistent compromise. In South Korea, attackers distributed **counterfeit adult games** via popular “webhard” file-sharing services; victims received a ZIP containing a decoy `Game.exe` launcher that stages additional components (`Data1.Pak`, `Data2.Pak`, `Data3.Pak`) and ultimately injects **QuasarRAT** (aka **xRAT**), enabling host profiling, keylogging, and unauthorized file transfer. The execution chain included masqueraded artifacts such as `GoogleUpdate.exe` and `WinUpdate.db`, with AES used to decrypt/extract shellcode prior to privilege escalation and RAT injection. Separately, a spear-phishing campaign weaponized news about a purported **Nicolás Maduro arrest** to deliver a **backdoor**: emails carried a ZIP with a lure executable (`Maduro to be taken to New York.exe`) alongside a malicious DLL (`kuguo.dll`) that abuses a legitimate KuGuo binary for execution. Post-run behavior included replication to `C:\ProgramData\Technology360NB`, persistence via an auto-start renamed binary (`DataTechnology.exe`), and C2 beaconing for tasking and configuration updates; researchers noted tradecraft consistent with **Mustang Panda** but said attribution was not yet confirmed. A separate research note described **GravityRAT** reemerging as a multi-platform RAT with expanded **Android** targeting (in addition to Windows/macOS), emphasizing mobile endpoints as increasingly high-value targets for data theft and persistent access, though it did not describe the same specific campaigns as the Windows-focused lures above.
Jun 29, 2026
Microsoft Threat Intelligence reported an active malware campaign targeting gamers by distributing **trojanized gaming utilities** through browsers and chat platforms, leading victims to execute a multi-stage downloader that ultimately installs a **Java-based remote access trojan (RAT)**. The infection chain was observed staging a portable Java runtime and launching a malicious JAR (`jd-gui.jar`), while using **PowerShell** and living-off-the-land binaries such as `cmstp.exe` to reduce detection. The activity includes defense evasion by deleting the initial downloader and adding **Microsoft Defender exclusions**, and persistence via a scheduled task and a startup script named `world.vbs`; the RAT then beacons to **`79.110.49[.]15`** for C2, enabling data theft and follow-on payload delivery. Reporting also noted the campaign’s use of gaming-adjacent filenames to increase execution likelihood (e.g., `Xeno.exe`, `RobloxPlayerBeta.exe`) and emphasized that the final payload functions as a **loader/runner/downloader/RAT** rather than a single-purpose stealer, increasing the risk of secondary malware deployment. Separately, one report highlighted the emergence of *Steaelite*, a Windows RAT advertised on criminal forums with claimed “FUD” capabilities and an integrated panel combining data theft and ransomware features, underscoring broader commoditization of multi-function RAT ecosystems even when not directly tied to the specific trojanized-gaming-tools intrusion chain.
Jun 29, 2026
Security researchers and sandbox telemetry identified malware campaigns abusing GitHub-hosted gaming cheat projects to distribute remote access trojans, including **AsyncRAT** and **VileRAT**. One analyzed sample was delivered from a GitHub raw URL and disguised as an *Escape from Tarkov* cheat-related `.scr` file, using a gaming-themed lure to entice users seeking cheats, DLL injectors, or other unauthorized tools. ANY.RUN classified the sample as malicious and linked it to **AsyncRAT**, a trojan that can provide remote control, keystroke capture, webcam access, and data theft from infected Windows systems. Additional reporting warned that attackers were packaging malware inside purported open-source game cheat repositories and injector utilities on GitHub, broadening the campaign beyond a single title or payload. Technical analysis tied related activity to **VileRAT**, indicating that threat actors are using trusted developer platforms and cheat-seeking communities as an infection channel for commodity and custom RAT malware. Reported indicators for the AsyncRAT sample included `SHA1 3065DA0D35988807C34C98164D35385F846AB1DF` and `SHA256 84C8AD42D82A82951A1968C738FC813A83FC5CD6F1C2F446F2960CF21A373E14`.
Jun 29, 2026