Fake Video Player Updates Deploy Miner and RAT Malware

Key Takeaways

• A long-running malware campaign is exploiting users of pirated content sites by presenting fake video player update prompts.
• Clicking these prompts infects systems with a cryptocurrency miner (SilentCryptoMiner) and a Remote Access Trojan (RAT).
• The malware employs sophisticated evasion tactics, including DLL side-loading, DNS tunneling, and a persistent watchdog component to resist removal.
• The campaign, active since at least 2022, targets millions of users monthly across illegal streaming, movie, and book platforms.

Overview: Fake Video Player Updates Deliver Miner and RAT

Cyber adversaries are leveraging a cunning social engineering technique to infect unsuspecting users with cryptocurrency mining and remote access malware. The attackers entice individuals visiting illicit streaming platforms for movies and TV shows with deceptive alerts, falsely claiming that their video player plugin is obsolete.

A single click on these fraudulent update buttons initiates a multi-stage infection process. This process covertly installs a cryptocurrency miner, silently exploiting the victim’s system resources, while simultaneously establishing a Remote Access Trojan (RAT) that grants attackers comprehensive control over the compromised machine. Details of this operation were extensively documented in a report by Securelist analysts, shared with Cyber Security News (CSN).

Campaign Uncovered and Its Extensive Reach

The campaign came to light in late April 2026, following a client’s request for assistance after detecting an unauthorized cryptocurrency miner operating on employee workstations. Subsequent investigations traced the origin of these infections to illegal streaming sites. On these platforms, users were duped by a fake plugin update prompt into downloading a malicious ZIP archive.

This archive initially appears innocuous, containing what seems to be a legitimate installer bundled with a concealed malicious library. Securelist analysts indicated that this is not a novel operation. Evidence suggests the same threat actor has been conducting similar campaigns since at least 2022, consistently refining their delivery mechanisms while maintaining the core deceptive strategy.

The scale of this threat is substantial. The pirated websites implicated in this campaign collectively garnered an estimated 40 million visits in April 2026 alone. The largest of these streaming platforms attracted between 2.1 million and 27.4 million monthly visitors, while even smaller digital libraries saw approximately 11,000 regular users each month. The campaign has also broadened its scope beyond streaming services to encompass online book and movie libraries, demonstrating the attackers’ wide-ranging targeting strategy.

Technical Breakdown of the Attack Chain

When a user navigates to one of the compromised sites and attempts to play content, a message appears, instructing them to update their plugin to proceed. Clicking this prompt downloads a ZIP archive. Inside this archive are two files: a legitimate-looking executable named HLS Installer.874.exe and a significantly sized malicious DLL.

Upon execution, the legitimate installer is used for DLL side-loading, allowing the malicious DLL to inject itself into a trusted system process. This technique enables the malware to operate under the guise of legitimate software, making detection more challenging. The malicious library is deliberately padded with junk code to impede analysis. Within its structure, a specific function intentionally triggers a stack overflow, meticulously crafting a chain of instructions that decrypts and loads the primary payload directly into memory.

The malware then establishes communication with the attacker’s command-and-control (C2) server via DNS tunneling. This method disguises malicious traffic as routine DNS queries, often mimicking legitimate Microsoft domain names to evade detection. Crucially, the malware only proceeds with its full operational capabilities after receiving an explicit approval signal from the C2 server, a tactic likely employed to filter targets and bypass security analysis environments.

Persistent Threat: Miner, RAT, and Watchdog Mechanisms

The primary payload consists of a modified version of SilentCryptoMiner, an open-source cryptocurrency miner. Once activated, it surreptitiously utilizes the victim’s CPU and GPU resources to mine cryptocurrency, often without any noticeable performance degradation that might alert the user. Concurrently, a separate RAT module runs in the background, providing attackers with remote access capabilities. This allows them to execute arbitrary commands, deploy additional files, and push further malware onto the compromised system at any time.

To ensure persistence, the malware registers itself as a fraudulent Google service, specifically named GoogleUpdateTaskMachineQC. This service is configured to launch automatically with every system startup. Furthermore, a resilient watchdog component operates within explorer.exe, constantly monitoring the miner’s activity every five seconds. If the miner is terminated or removed, this watchdog automatically restores it from an encrypted backup. Security professionals attempting to clean an infected system must first identify and terminate this watchdog process within explorer.exe; otherwise, the miner will simply reinstall itself, thwarting cleanup efforts.

What You Should Do

• Avoid Pirated Content: Refrain from visiting illegal streaming, movie, and book sites, as these are the primary vectors for this and similar threats.
• Be Skeptical of Updates: Never click on “update” prompts directly from websites, especially for plugins or software. Always go to the official vendor’s website to download and install updates.
• Monitor Network Traffic: Watch for unusual DNS traffic patterns or DNS requests mimicking legitimate domains but pointing to suspicious IP addresses.
• Inspect System Services: Regularly check for unrecognized or suspicious services, particularly those masquerading as legitimate system components like “GoogleUpdateTaskMachineQC.”
• Monitor Process Activity: Look for unexpected code injection into critical system processes such as explorer.exe or conhost.exe.
• Endpoint Protection: Ensure all endpoint detection and response (EDR) solutions and antivirus software are up-to-date and configured for real-time monitoring.
• File System Monitoring: Monitor for unexpected file creations or modifications in sensitive directories, such as C:ProgramDataGoogleChrome (though not a legitimate Google Chrome path).
• Incident Response Plan: Develop and practice an incident response plan for malware infections, emphasizing the steps required to neutralize persistent threats like the described watchdog component.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.