Loading story…
Researchers reported multiple campaigns using fake download and streaming sites to compromise users with remote access tools, malware, and proxyware. Kaspersky found more than 90 spoofed domains in 10 languages promoting bogus Windows software downloads through search engine optimization; the delivered archives used DLL sideloading to install the expected application alongside ScreenConnect, then deployed AsyncRAT for persistent access. In one investigated case, the attackers altered Microsoft Defender exclusions, disabled User Account Control, and used process hollowing into RegAsm.exe to launch the payload, creating risk for both consumers and enterprise networks because remote administration tools are often allowlisted and may run with elevated privileges.
A parallel set of campaigns abused demand for free media and utilities to lure victims into installing unwanted software that can expose systems and internet connections to criminal use. Researchers tracking World Cup-themed piracy sites found rotating mirror domains, typosquatting, and cloud-hosted pages pushing fake Stremio installers, VPN-themed lures, and affiliate-style downloads tied to malware, phishing, and scams. Separate analysis of a fake 7-Zip installer showed a Go-based backdoor that converted infected Windows hosts into residential proxy nodes, while broader threat reporting warned that free VPNs, streaming apps, browser extensions, and cheap IoT products are increasingly used to build residential proxy networks that criminals exploit for fraud, scraping, account abuse, and evasion.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Researchers identified a high-severity campaign exploiting interest in the 2026 FIFA World Cup through a large network of pirated sports-streaming websites. The operation used mirror domains, typosquatting, cloud-hosted pages, and domain rotation, and also pushed fake Stremio installers and VPN-themed lures.
The article reported that in 2026, 65% of Infoblox Threat Defense Cloud customers made DNS queries to domains associated with accessing or orchestrating residential proxy networks, totaling more than 500 billion queries per month. The activity was linked to abuse of consumer devices through free VPNs, streaming apps, browser extensions, and IoT products.
Researchers assessed that the ScreenConnect campaign appeared to pause by late March 2026, although many lure sites remained online. In investigated infections, attackers used ScreenConnect to deploy AsyncRAT and weaken host defenses.
Kaspersky said registrations of spoofed domains used in the ScreenConnect malware campaign peaked in February 2026. The broader operation used more than 90 domains in 10 languages and promoted them through SEO.
Researchers reported that in January 2026 the ScreenConnect campaign changed its lure strategy from fake game sites to free utility downloads. Victims were served malicious archives that silently installed both the expected software and ScreenConnect via DLL sideloading.
Kaspersky researchers said the infrastructure for a malware campaign abusing ScreenConnect began forming in October 2025. The operation later used spoofed domains and fake software-download sites to deliver ScreenConnect and AsyncRAT.
Analysis described a malware campaign in which a fake 7-Zip installer from 7zip[.]com deployed a Go-based Windows backdoor that turned infected hosts into residential proxy nodes. The trojanized installer was signed with a now-revoked JOZEAL NETWORK TECHNOLOGY CO., LIMITED certificate and established persistence and outbound connections to hero/smshero-themed infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecommunity.gurucul.com
Open sourcecysecurity.news
Open sourceblog.lukeacha.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are using **software impersonation** and **SEO poisoning** to push victims toward fake download sites for trusted enterprise and IT tools, then delivering malware through trojanized installers. In one campaign, **Storm-2561** used spoofed VPN vendor pages for products such as **Pulse Secure, Fortinet, and Ivanti** to steal enterprise VPN credentials. The malicious packages were hosted on GitHub, signed with a certificate issued to **"Taiyuan Lihua Near Information Technology Co., Ltd."**, and designed to show an error before redirecting victims to the legitimate vendor site, reducing suspicion while exfiltrating credentials. A separate but closely related campaign used fake **FileZilla** download pages to distribute a **Remote Access Trojan** through multi-stage loaders and **DLL sideloading**. Attackers bundled legitimate FileZilla software with a malicious `version.dll`, or dropped the DLL during installation so the malware would execute while the expected application appeared to install normally. Both reports describe the same broader intrusion pattern: adversaries abusing trusted brands, realistic lookalike websites, and legitimate software packaging to compromise users who believe they are downloading authentic tools. A separate **Warlock** intrusion analysis describing web shells, lateral movement, tunneling, and ransomware activity is a different incident and does not match this malware-delivery story.
Jun 29, 2026
Kaspersky reported a large malware campaign that used spoofed, SEO-poisoned software download sites to distribute trojanized installers that silently deployed **ScreenConnect** and then **AsyncRAT**. The fake sites impersonated widely used tools including **OBS Studio**, **DNS Jumper**, **DS4Windows**, **Bandicam**, **Glary Utilities**, and **Process Hacker**, targeting both individual users and organizations across localized pages in 10 languages. Researchers identified more than 90 domains tied to the operation and linked the activity to multiple hosting and command-and-control clusters. The infection chain abused DLL sideloading by pairing a legitimate Microsoft-signed `install.exe` with a malicious `install.res.1033.dll`, allowing attackers to covertly install ScreenConnect before launching PowerShell and VBS scripts to weaken defenses and establish persistence. The attackers then injected AsyncRAT into `RegAsm.exe` using process hollowing, with infrastructure analysis connecting the campaign to ScreenConnect C2 domains and an AsyncRAT controller at `mora1987[.]work[.]gd`. Kaspersky assessed that the operation began in October 2025, expanded through early 2026, and appeared to pause at the end of March 2026.
Jul 12, 2026
A large-scale campaign has impersonated popular open-source and freeware projects, including **Ghidra**, **dnSpy**, and **SpiderFoot**, to capture search traffic and hijack software download clicks. Researchers found that the fake sites use CloudFront-hosted JavaScript to intercept a visitor’s first interaction and send users into a gated Traffic Distribution System (TDS) that performs anti-bot screening, VPN and datacenter filtering, click confirmation, and frequency capping before deciding what content to serve. The infrastructure appears primarily built for traffic acquisition and monetization, but selected victims were repeatedly routed into malware delivery chains. Those chains included **SessionGate**, a heavily obfuscated multi-stage framework with strong anti-analysis protections that mainly delivered potentially unwanted applications, as well as **RemusStealer** and **AnimateClipper**, which were used to deploy an infostealer and a cryptocurrency clipper. Researchers said the operation has been active since at least late 2025, with active malware distribution observed from early 2026 and more than **5,000** VirusTotal submissions indicating significant scale.
Jun 29, 2026