Loading story…
Automatic updates from the Download Studio torrent client and the adblockers NetShield Kit, My AdBlock, and Net AdBlock were used to deliver a fake Malwarebytes installer that deployed the FakeMBAM backdoor and a Monero miner based on XMRig. Avast said it blocked the malicious files on nearly 100,000 Avast and AVG-protected devices, with most activity concentrated in Russia, Ukraine, Kazakhstan, and Eastern Europe. The malware was commonly delivered as MBSetup2.exe, displayed a fake setup wizard, and falsely told victims that Malwarebytes had been installed successfully even though the software did not come from official Malwarebytes channels.
Analysis of the installer showed it repackaged legitimate Malwarebytes components and used a DLL side-loading chain to install malicious files in a fake Malwarebytes directory, create persistence through a Windows service named MBAMSvc, and contact command-and-control infrastructure for encrypted configuration updates. The backdoor could also fetch and maintain additional payloads, including a miner identified as Bitminer, and Avast reported code and infrastructure overlaps linking the trojanized applications and the backdoor to the same actor or a closely connected compromise. Download Studio’s developers later said a CI server security incident may have enabled the malicious updates, but the full root cause and total victim impact remained unclear.
Trace attribution and downstream blast radius.
3 events from the most recent confirmed update back to the earliest known activity.
On August 21, 2020, Avast detected fake Malwarebytes installation files carrying a backdoor. The campaign affected nearly 100,000 Avast and AVG users, with activity concentrated in Russia, Ukraine, and Eastern Europe.
Download Studio's developers told Avast they detected a security incident on their continuous integration server in August 2020. They said they investigated and added security measures, but did not clarify user impact or notification.
Avast's later investigation found that the FakeMBAM backdoor was being delivered through automatic updates of the Download Studio torrent client and the NetShield Kit, My AdBlock, and Net AdBlock applications. Reverse engineering and infrastructure overlaps suggested a common actor or closely connected compromise behind all four applications.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 24 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
decoded.avast.io
Open sourcegendigital.com
Open sourceblog.avast.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a large-scale **malware distribution campaign** that used fake software offerings hosted on trusted platforms to infect users, with operators increasingly relying on **AI-assisted or “vibe-coded” development** to scale payload creation. McAfee identified more than **443 malicious ZIP archives** masquerading as AI tools, game cheats, VPNs, drivers, and decryptors, distributed via services including *Discord*, *SourceForge*, *FOSSHub*, *MediaFire*, and *mydofiles.com*. The campaign used **48 variants** of `WinUpdateHelper.dll` across **17 kill chains**, each with separate command-and-control infrastructure but linked through shared cryptocurrency wallet credentials, allowing researchers to trace monetization activity and victim distribution across countries including the US, UK, India, Brazil, France, Canada, and Australia. A separate but related report described another **multi-stage malware campaign** that also relied on deceptive delivery and evasion, using **.NET Ahead-of-Time (AOT) compilation** to hinder analysis and a host-scoring system to avoid sandboxes and low-value targets. In that intrusion chain, a phishing-delivered ZIP launched `KeyAuth.exe`, which fetched `bound_build.exe` and then deployed both the **Rhadamanthys infostealer** and an **XMRig** miner disguised as *MicrosoftEdgeUpdater*. The malware checked conditions such as RAM, uptime, document count, and active antivirus processes, and terminated itself if the environment scored below a threshold, showing a deliberate effort to evade detection while maximizing successful infections.
Jun 29, 2026
Researchers identified a campaign using at least **41 fake download websites** that impersonate popular games and Windows software, including **VLC**, **7-Zip**, **Paint.NET**, **Roblox**, **PUBG**, **Counter-Strike**, and **VMware**, to trick visitors into installing **Download Studio** instead of the product they selected. The pages display convincing product information and even show legitimate destination URLs on hover, but JavaScript intercepts the click and silently redirects users through an affiliate chain to a different installer. The delivered file analyzed by researchers was a roughly **73 MB** Windows executable signed by **Grand Media, TOV**, which installed Download Studio, enabled automatic updates, and in some cases registered torrent and magnet associations. Researchers said Download Studio was not confirmed as malware in this campaign, but warned that its updater was previously abused in 2020 to distribute the **FakeMBAM** backdoor and cryptocurrency miners, making the forced-installation tactic especially risky and underscoring the need to obtain software only from official vendor sites or trusted stores.
Aug 20, 2026
Researchers reported two malware campaigns that install cryptocurrency miners through trojanized downloads delivered from pirate streaming sites and fake software portals. In one operation, users visiting illicit movie and TV sites were shown a bogus video-plugin update that delivered a ZIP archive containing a legitimate executable and a malicious DLL; the DLL sideloaded a multi-stage miner framework with persistence, defense evasion, a watchdog, a **RAT** component, and CPU/GPU mining modules. The malware, a modified fork of SilentCryptoMiner, used DNS tunneling for execution gating, installed a service named `GoogleUpdateTaskMachineQC`, weakened Windows defenses, injected into `conhost.exe` and `explorer.exe`, and communicated through rotating domains and infrastructure tied to `107[.]172[.]212[.]235`. Microsoft described a related cryptojacking-focused campaign aimed at owners of high-performance PCs, using fake downloads of popular utilities and hardware-monitoring tools that were promoted through SEO poisoning and, more recently, surfaced in AI assistant recommendations. Those ZIP archives also paired a legitimate executable with a malicious DLL for sideloading, then installed **ScreenConnect** for persistent remote access, set registry autoruns and scheduled tasks, added Microsoft Defender exclusions, checked for analysis tools, and used process hollowing to launch payloads inside trusted Windows processes. After profiling infected systems, the attackers fetched GPU miners including **gminer**, **lolMiner**, and **SRBMiner-MULTI**; researchers warned the access could support not only cryptomining but also data theft, lateral movement, and eventual ransomware deployment.
Jun 29, 2026