Unit 42 uncovered a large pay-per-install (PPI) malware distribution operation (CL-CRI-1171) that tricked people into downloading trojanized software through YouTube gaming videos and poisoned search results. The lures looked like normal gaming “optimization” content or legitimate utility/driver downloads, but the downloads installed a loader (“OfferLoader”) that delivered multiple malware payloads. The same infrastructure used gating/evasion so scanners saw decoy pages while real users received malware.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You’re on YouTube, watching a legit gaming tips video. In the description: “optimization pack – boost FPS, download here.” You click it and land on a fake download page: big green “Download File” button, a little “Check viruses” animation. It looks safer than the real thing, then quietly drops a trojanized installer instead. Unit 42 found this CL-CRI-1171 campaign pushing trojanized tools like fake Bluetooth drivers and windirstat.exe. Young gamers got hit, and so did corporate endpoints, even critical infrastructure. Here’s the move: if a video or random page says “download this tool,” don’t click. Open a new tab, go to the official vendor site or our software portal, and download it from there.
Two real, ongoing intrusion campaigns targeted organizations in Latin America, including a Mexican transportation organization and Brazil’s financial sector. In the Brazil campaign, attackers reportedly got in via a resume-themed phishing attachment, then attempted to download and run tunneling…
Researchers observed a coordinated social-engineering operation (“Spring Ring”) where attackers used external Microsoft Teams accounts to pose as internal IT help desk staff and start voice calls. Victims were pressured to install remote-control tools (like Quick Assist or other RMM software) or…
Palo Alto Networks’ Unit 42 reviewed 405 “AI-linked” malware samples and found most never reached real victims, but a small set did spread in the wild. Several successful samples relied on deception, posing as legitimate installers (e.g., a recipe app, Dropbox, and security software components), to…
A large review of “AI-enabled malware” found most samples were proof-of-concepts, but a small set were real threats seen in production environments. The real-world activity included trojanized installers that pretended to be legitimate apps (like a recipe app or a Dropbox installer) and relied on…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
Researchers tied several new programs to the REVSTEALER Windows info-stealer that can steal crypto wallet data, hijack clipboard crypto addresses, and even disable Windows Update and Microsoft Defender to run a crypto miner. Victims are primarily pulled in through “game-cheat” downloads promoted by…
