Loading story…
Researchers linked the InstallCapital pay-per-install (PPI) operation to the delivery of multiple malware families through fake warez sites, a WordPress plugin, and a sprawling but centralized domain network. The installer fetched available offers from infrastructure referenced through Pastebin, then delivered second-stage payloads to victims who matched campaign conditions. Across 2017 to 2020, investigators observed more than 500 offers and nearly 200,000 domains tied to the operation, with testing showing distribution of Glupteba, Dreambot, and Legion Loader, the latter later dropping Raccoon Stealer.
One of the payloads, Glupteba, was documented as a modular malware platform spread via malvertising that expanded beyond a botnet into credential theft, proxy abuse, and resilient command-and-control. Its newer variants stole browser cookies, history, and credentials from Chrome, Opera, and Yandex; exploited MikroTik routers via CVE-2018-14847 to steal administrator credentials and convert devices into SOCKS proxies; and used encrypted communications plus Bitcoin OP_RETURN data to recover updated C2 domains. The combined reporting shows how adware-style PPI distribution can serve as an initial access channel for more capable malware that steals data, hijacks network infrastructure, and maintains durable access.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
During the third day of testing in January 2020, CSIS observed InstallCapital distributing Legion Loader from api-update1[.]biz. Legion Loader was then used to drop Raccoon Stealer.
In the same January 2020 testing period, InstallCapital was configured to drop the first-stage loader ImpulseLTD and then deliver the Dreambot banking trojan. The Dreambot sample was identified with bot group ID 1000, version 2.17.10.7, and both onion and clearnet command-and-control endpoints.
During testing in January 2020, CSIS observed InstallCapital delivering Glupteba via a second-stage payload URL. The article describes Glupteba as malware used mainly for cryptocurrency mining and lateral movement on local networks.
The Trend Micro article says a 2018 report found the Glupteba botnet may have become independent from Operation Windigo and shifted to pay-per-install adware distribution. This marked an earlier change in how the malware was being spread.
The CSIS analysis states that researchers observed nearly 200,000 domains associated with the InstallCapital pay-per-install operation between 2017 and 2020, all resolving to the same IP address. This documented the scale and centralized nature of the distribution infrastructure.
Trend Micro reported that a Glupteba malvertising campaign was distributing a variant with added browser-stealing and MikroTik router-exploitation components. The report also described Glupteba's ability to recover updated command-and-control domains from Bitcoin transaction OP_RETURN data.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 45 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Breakglass Intelligence reported that an Amadey botnet campaign tracked as **`fbf543`** functioned as a large pay-per-install service rather than a single malware run, linking more than 100 samples across **24 malware families** over roughly 10 days. The operation used **`sys32[.]cc`** as a Cloudflare-fronted Amadey C2 while backend and payload hosting were tied to **`labinstalls[.]info`** at **`158.94.211.222`**, with additional delivery infrastructure including **`qpgroup[.]top`** and bulletproof hosting providers such as Omegatech, 1337 Services, and Podaon SIA. Researchers said the service likely served multiple criminal customers and assessed it as a financially motivated mid-tier cybercrime operation with likely ties to the CIS criminal ecosystem. The campaign delivered a broad mix of malware including **Vidar**, **LummaStealer**, **QuasarRAT**, **XWorm**, **SmokeLoader**, **Mirai**, and **ScreenConnect**, with Vidar appearing most often in 29 samples across two distinct lineages. Delivery methods included a Delphi PE wrapped in Inno Setup, confirmed **`version.dll`** sideloading, an HTA dropper abusing **`mshta.exe`** and **`curl.exe`** to fetch payloads from **`188.137.224.92`**, a fake Roblox executor using a modified VMware Tools binary, LimeWire-hosted payloads, and ConnectWise RMM MSI packages signed with legitimate certificates. The report said the operators mixed evasive tradecraft such as anti-VM checks, ping delays, XOR-encoded dead-drop resolvers, Cyrillic homoglyphs, and stolen or abused code-signing certificates with operational mistakes including a self-descriptive backend domain and predictable payload URL patterns.
Jun 29, 2026
Palo Alto Networks Unit 42 identified **CL-CRI-1171**, a long-running pay-per-install operation that uses its custom **OfferLoader** malware to distribute payloads for separate criminal operators. The group lures victims through SEO-poisoned fake software-download sites and at least 11 gaming-focused YouTube channels offering trojanized installers. The search-result campaign has affected corporate, government, and critical-infrastructure endpoints, demonstrating that commodity download lures can lead to enterprise compromise. OfferLoader fingerprints victims and gates payload delivery to limit scanner visibility; researchers found more than 10,000 distinct loader samples and over 200 rotating domains. Payloads observed in 2026 included **Insomnia RAT**, **ARKTunnel**, and **Docro Hijacker**, followed by **GCleaner** and **Socks5Systemz**, enabling remote access, network tunneling, proxy services, and Chrome search and advertising hijacking. The operation illustrates the use of ATT&CK `T1608.006` SEO poisoning, in which attackers manipulate search rankings and may use cloaking or redirects to steer targets to malicious infrastructure while evading inspection.
Sep 14, 2026
Multiple active malware campaigns are using **trojanized installers** and social engineering—rather than software vulnerabilities—to gain initial access and then deploy credential theft or remote-control capabilities. Intel 471 reported a new Android banking trojan dubbed **FvncBot** targeting Polish mobile banking users by impersonating an *mBank* “security” app; the dropper prompts installation of an additional “Play” component and then abuses **Android Accessibility Services** for persistence and control, enabling **keylogging**, **screen capture**, and hidden **VNC-style remote interaction** to facilitate fraudulent transactions. Separately, Cyderes described an ongoing, large-scale piracy-channel campaign where cracked game installers hide behind a legitimate-looking **Ren’Py** launcher tracked as **RenEngine**, which decrypts and launches subsequent stages and introduces **HijackLoader** via techniques including **DLL side-loading** and module stomping; observed final payloads include **ACR Stealer** (and in some cases **Vidar**) to exfiltrate browser credentials, cookies, and crypto wallet data. Cybereason detailed a different installer-themed operation in Chinese-speaking communities delivering **ValleyRat/Winos 4.0** attributed to **Silver Fox APT**, notable for using the rare **“PoolParty Variant 7”** process injection (abusing Windows I/O completion ports and `ZwSetIoCompletion()` after duplicating a handle from `Explorer.exe`) plus a strengthened watchdog mechanism via injection into `Explorer.exe` and `UserAccountBroker.exe` to maintain persistence.
Jun 29, 2026