Fake Utility Downloads Used to Deploy ScreenConnect and Crypto Mining Malware

A sophisticated cryptojacking campaign that leverages manipulated search engine results and AI chatbot interactions to distribute malware.

Attackers are actively spoofing popular system utilities to trick users into downloading compromised packages.

Microsoft Security researchers noted that this emerging delivery technique extends social engineering beyond conventional search results, thereby increasing the visibility of malicious recommendations.

The primary goal of this operation is to infect systems with high-performance GPUs to maximize cryptocurrency mining yields, while also establishing persistent remote access via abused ScreenConnect deployments for potential follow-on attacks such as data theft or ransomware.

Fake Utilities Deploy Miners

The campaign begins when hardware enthusiasts search for trusted utilities such as CrystalDiskInfo, HWMonitor, or Display Driver Uninstaller. Security analysts observed that users querying large language model tools for software recommendations were occasionally presented with links to attacker-controlled domains within the generated responses.

Each fake site offers a ZIP archive hosted on dynamic DNS subdomains that contains a legitimate executable alongside a malicious dynamic link library.

When a victim launches the executable, the program silently loads the malicious library via a technique known as DLL sideloading.

This initial payload then quietly installs a secondary file masquerading as a Visual C++ redistributable, which is actually a packaged installer for the ScreenConnect remote management tool.

To maintain a stealthy footprint, the malware attempts to hollow out a legitimate Microsoft-signed binary, choosing from several standard Windows utilities that ship with the .NET Framework.

The malicious mining code runs under the identity of a trusted binary, while the malware simultaneously invokes PowerShell commands to register both path- and process-based exclusions in Microsoft Defender.

The malware also performs extensive anti-analysis checks to ensure it is not running in a virtual machine or alongside debugging tools.

According to Microsoft threat intelligence reports, the hollowed process continuously monitors user activity and GPU usage, pausing its mining operations if it detects heavy, legitimate usage, such as gaming, to avoid drawing suspicion.

The command-and-control infrastructure uses an encrypted WebSocket connection and hard-coded certificate pinning to orchestrate the final stages of the attack.

Depending on the compromised hardware profile sent during the host reconnaissance phase, the malware dynamically downloads specialized GPU mining tools such as gminer or lolMiner.

The infection chain relies on a highly resilient persistence mechanism that constantly checks scheduled tasks, registry keys, and startup folders to recreate any components that have been removed.

This continuous background routine ensures the illicit cryptocurrency mining operation remains active and undisturbed on infected systems.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.