Threat Actors Exploit Fake Utility Downloads to Install ScreenConnect, Mine Crypto

Key Takeaways

• A widespread cryptojacking operation is luring users with fake software download sites and even AI chatbot recommendations.
• The attackers deploy GPU-based cryptocurrency miners and install ScreenConnect for persistent remote access.
• The campaign specifically targets users with high-performance graphics cards, such as gamers and AI developers.
• Over 150 fraudulent download portals mimic popular utilities like CrystalDiskInfo and HWMonitor.
• Organizations and individuals should exercise extreme caution when downloading software and monitor for unusual GPU activity.

Cybercriminals Leverage Fake Utility Downloads and AI Chatbots for Cryptojacking and Persistent Access

Cybersecurity researchers have uncovered an extensive cryptojacking campaign that tricks users into downloading malware-infected software, subsequently exploiting their systems for cryptocurrency mining. This sophisticated operation not only uses a vast network of deceptive download portals but has also been observed leveraging AI chatbot recommendations to spread its malicious payload, according to a recent report by Microsoft.

The attackers have established more than 150 counterfeit websites designed to impersonate legitimate download sites for popular PC utilities. These include well-known applications such as CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec Pack, and PDFgear. Users searching for these utilities online and encountering these fake sites are prompted to download ZIP archives that, unbeknownst to them, contain both the legitimate software and hidden malicious files.

Targeting High-Performance Systems and AI Chatbot Distribution

Analysts at Microsoft, who detailed their findings in late May 2026, noted that the campaign is strategically aimed at individuals likely to possess powerful graphics cards. This includes gamers, hardware enthusiasts, and AI developers, maximizing the illicit mining potential from each compromised machine. “The campaign deliberately targets users who likely own high-performance graphics cards, including gamers, hardware enthusiasts, and AI developers,” stated the Microsoft Defender Experts and the Microsoft Defender Security Research Team in their report shared with Cyber Security News (CSN).

A particularly concerning development observed in April 2026 is the campaign’s expansion beyond traditional search engine poisoning. Researchers documented instances where users received direct links to attacker-controlled domains through AI chatbot recommendations when querying for software download suggestions. This represents a significant shift, exploiting a vector many users might perceive as more trustworthy than standard web search results.

The Infection Chain: From DLL Sideloading to Remote Control

The compromise begins when a user executes what appears to be a legitimate utility installer downloaded from one of the fake sites. The downloaded ZIP file contains the authentic application along with a malicious DLL, named autorun.dll. This rogue file is automatically loaded when the legitimate program launches, a technique known as DLL sideloading, which often bypasses traditional security measures and leaves no visible trace.

Upon execution, autorun.dll deploys a second malicious file, vcredist_x64.dll, via Windows Installer. This file acts as a packaged installer for ScreenConnect, a legitimate remote access software. Once ScreenConnect is established, the infected system connects to an attacker-controlled command-and-control (C2) server at 193.42.11[.]108. Through this remote access channel, the attackers push an executable named SimpleRunPE.exe to the victim’s machine.

SimpleRunPE.exe is central to the cryptojacking operation. It establishes persistence through Registry Run keys and scheduled tasks, configures security tool exclusions to evade detection, and employs process hollowing to inject mining code into a trusted Microsoft-signed binary. Depending on the system’s configuration, one of three GPU miners—gminer, lolMiner, or SRBMiner-MULTI—can be deployed. To avoid detection, the malware actively monitors for analysis tools like Windows Task Manager, Process Hacker, and Process Explorer, pausing mining activity when these tools are running and resuming stealthily once they are closed.

Persistent Access and What Defenders Should Do

Beyond the immediate financial gain from cryptojacking, the deployment of ScreenConnect grants the attackers persistent remote access to compromised systems. This backdoor capability means that even if the mining software is detected and removed, the attackers can retain a foothold, enabling future malicious activities such as data exfiltration, lateral movement within corporate networks, or even ransomware deployment. The campaign remains active and continues to expand its reach.

What You Should Do

• Verify Software Sources: Always download software directly from official vendor websites. Avoid third-party download sites or links from untrusted sources, including those suggested by AI chatbots, unless independently verified.
• Monitor GPU Usage: Implement monitoring for unusual or sustained spikes in GPU usage on desktops and servers, which can be an early indicator of unauthorized cryptocurrency mining.
• Inspect Remote Access Tools: Actively look for unauthorized installations or sessions of remote access software like ScreenConnect that are not approved or managed by IT.
• Enhance Endpoint Detection: Configure security solutions to alert on the presence of suspicious files such as SimpleRunPE.exe, autorun.dll, or vcredist_x64.dll appearing in unexpected directories.
• Block Malicious Infrastructure: Block known malicious IP addresses and domains, including the C2 server 193.42.11[.]108 and subdomains of gleeze[.]com, at the network perimeter.
• Educate Users: Train users to be skeptical of software download links, regardless of the source, and to cross-reference information with official vendor sites.

Indicators of Compromise (IoCs):-

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.