Loading story…
Threat researchers reported a malware campaign that used fake privacy-tool websites to trick users into downloading trojanized Windows installers that delivered SmokeLoader. Identified lure domains included privacytools[.]xyz, privacytoolsforyou[.]site, privacmytools[.]site, and privacy-tools-for-you-777[.]com, with one malicious installer tracked by SHA-256 47906fc0ac7d3be54c62933e5f66a285cd34f161ce1d8a1bbdf80dc2e1df1441. The operation relied on spoofed software-download pages and rogue file-hosting sites designed to resemble legitimate privacy software distribution.
Investigators linked the activity to a broad and frequently changing infrastructure that included at least 26 fake privacy-tool domains, 18 related file-hosting domains, numerous command-and-control URLs across TLDs such as .space, .ru, .site, .xyz, and .com, and shared bulletproof hosting. Some file-hosting domains also appeared to serve as SmokeLoader C2 nodes, while additional indicators included DNS-linked IP addresses and RSA key material associated with encrypted malware communications, underscoring a coordinated malware delivery and control network.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
The domains privacytoolzforyou-7000[.]com and privacytoolzfor-you7000[.]com were registered on 19 November 2021 as part of the fake privacy-tool campaign. Silent Push linked them to the broader malicious domain cluster.
Silent Push reported that the fake privacy-tool campaign switched to its current bulletproof hosting provider sometime in September 2021. This marked an infrastructure change affecting both the fake software sites and related rogue file-hosting domains.
Silent Push found related fake privacy-tool domains dating back as early as June 2021, indicating the malware distribution campaign was already active by then. The domains were assessed as part of the same actor's infrastructure serving SmokeLoader.
Silent Push identified at least 26 fake privacy-tool domains and 18 similarly patterned rogue file-hosting domains, assessing that they were very likely operated by the same actor. It also found that some of the file-hosting domains appeared to function as SmokeLoader command-and-control infrastructure.
Proofpoint identified fake download domains including privacytools[.]xyz, privacytoolsforyou[.]site, and privacmytools[.]site, along with a large rotating set of command-and-control URLs, DNS infrastructure, and RC4 key values. The disclosure documented an organized malware delivery and C2 operation using trojanized privacy-tool downloads.
Silent Push reported that privacy-tools-for-you-777[.]com had been registered the previous day and was live masquerading as a privacy tool website. Its installer download was identified as malware, and URLhaus reported files from the same URL as SmokeLoader.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers traced multiple **SmokeLoader** operations to live command-and-control infrastructure that supported credential theft, screenshot capture, clipboard theft, host profiling, and data exfiltration. One March 2026 campaign used a **ClickFix** social-engineering lure, an MSI installer, and a Go-based loader to deploy the **Remus** plugin, with exfiltration sent to `baxe[.]pics:48261`; investigators extracted configuration data including the C2 URL, campaign ID, plugin markers, and a **ChaCha20** key that allowed captured traffic to be decrypted. Cross-sample analysis linked the same builder output to SmokeLoader deliveries via **Amadey**, **Phorpiex**, and the ClickFix/GOLoader chain, pointing to a shared malware-as-a-service or affiliate ecosystem. Separate analysis tied SmokeLoader to a broader dual-family operation involving **Fuery**, likely run by an operator using the alias **"ingermany"**, who used a Flask-based panel disguised as **"InsureFlow Pro"** and a second **"Monkey"** panel for Fuery management. Investigators documented repeated OPSEC failures across the infrastructure, including reused certificates, exposed registration data, same-day domain registrations, and a C2 domain that shared a VPS with a legitimate Arabic-language learning platform, `qimmaedu[.]com`, while malware traffic beaconed to `coox[.]live` and `baxe[.]pics`. The reports also highlighted unusual technical overlaps, including Go 1.20.1 builds, Raft protocol type-name obfuscation, split C2 services on high ports, and hosting links to providers and subnets previously associated with **Phorpiex**, reinforcing the assessment that financially motivated operators were reusing infrastructure across malware families and legitimate services.
Jun 29, 2026
Threat researchers reported separate malware campaigns that used fake or pirated software distribution channels to infect Windows users with credential theft and traffic-interception malware. In one campaign, attackers seeded cracked software sites with a trojanized `WinX_DVD_Copy_Pro.exe` that launched an obfuscated HTA through `MSHTA`, deployed an upgraded **CountLoader v3.2**, and ultimately delivered **ACR Stealer** entirely in memory. The loader established persistence with scheduled tasks, profiled infected hosts, authenticated to command-and-control with a JWT token, and supported additional payload delivery through ZIP, DLL, MSI, PowerShell, and removable-media propagation tasks. A second campaign abused interest in **DeepSeek-R1** by promoting a fake DeepSeek site through Google Ads and delivering a malicious installer, `AI_Launcher_1.21.exe`, backed by fake CAPTCHA pages, PowerShell, AES-decrypted payloads, and a domain-generation routine. The final malware, **BrowserVenom**, installed a rogue root certificate and reconfigured browsers to send traffic through the attacker-controlled proxy `141.105.130[.]106:37121`, allowing interception and collection of user web activity. Researchers said the operations relied on impersonation-themed infrastructure and low-detection payloads to evade defenses, with BrowserVenom infections observed in Brazil, Cuba, Mexico, India, Nepal, South Africa, and Egypt.
Aug 14, 2026
Researchers linked **PrivateLoader** to a long-running pay-per-install malware ecosystem that used SEO-poisoned sites and cracked-software lures to infect Windows users with password-protected ZIP archives and NSIS installers. The loader was repeatedly observed delivering a wide range of payloads, including **RedLine**, **Vidar**, **SmokeLoader**, **RisePro**, **Qbot**, **Dridex**, **DanaBot**, **TrickBot**, **Kronos**, **LockBit**, **STOP Djvu**, and **Conti**, while related tooling such as **Discoloader** and the Go-based **Anubis Loader** expanded the same distribution chain. Investigations described administration panels used to manage payload links, browser extensions, bot installs, and operator activity, with one panel reportedly overseeing about **20,000 bots** and collecting more than **11 GB** of stealer logs in less than two weeks. Separate reporting showed PrivateLoader also acting as an access broker for other criminal and state-linked operations. Analysts observed it distributing **ColibriLoader** in a campaign tied to **UAC-0113**, a group CERT-UA has associated with **Sandworm**, and later delivering **Socks5Systemz**, a proxy botnet that converted infected Windows hosts into rentable proxies. Bitsight estimated Socks5Systemz had about **10,000 infected systems** and at least **53 servers** supporting command-and-control, telemetry, DNS, and backconnect functions, with customers buying proxy access through a Telegram-linked service for cryptocurrency. Across the reporting, PrivateLoader emerged as a versatile initial-access platform connecting commodity stealers, banking trojans, ransomware, proxy monetization, and higher-end intrusion activity.
Aug 15, 2026