Microsoft has warned that hotel, conference, and other hospitality Wi-Fi networks are being actively abused by a Russian group to target travelers worldwide. The campaign, dubbed “CaptiveCrunch” turns a routine Wi-Fi login moment into an opportunity to compromise corporate accounts and devices.
From the user’s perspective, nothing looks out of the ordinary: they connect to hotel Wi-Fi, get the usual captive portal prompt, and perhaps see a familiar‑looking message about needing to update something before they can browse. However, behind the scenes, the allegedly state-linked group position themselves in the network path and manipulate DNS (Domain Name System) and HTTP traffic from captive‑portal Wi-Fi.
From there, several things can happen:
Logins are stolen: The user’s browser session is redirected to attacker‑controlled phishing pages, like fake Microsoft login prompts, where credentials, device codes, or OAuth tokens are harvested.
Malware is downloaded: The user is presented with fake update or ClickFix dialogs that download malware. In these cases, usually a remote access trojan (RAT) plus an infostealer.
A machine-in-the-middle attack (MitM) where traffic is quietly proxied through attacker infrastructure, putting the user in a position for further credential theft.
Reportedly, one of the main malware strains used in these attacks is called CornFlake, a remote access trojan (RAT) that can capture webcam images, microphone audio, and keystrokes.
The infostealer was identified as ChocoShell, a fileless Powershell-based information stealer which primarily goes after browser session cookies, saved passwords, Microsoft 365 Single Sign-On (SSO) tokens, and Wi-Fi credentials from compromised systems.
Microsoft lists a set of fake dialogs that may appear once you connect to compromised Wi‑Fi:
winupdate: A bogus Windows Update window with “Working on updates… Don’t turn off your computer.”
defender: A fake Windows Security virus scan.
directx: “DirectX End‑User Runtime Web Installer.”
vcredist: A Microsoft Visual C++ redistributable installer.
sysopt: A disk optimization utility.
netfix: A Windows Network Diagnostics ‘fix’ tool.
browser: A browser update prompt.
pdfview: A document/PDF viewer installer.
How to stay safe
Malwarebytes has long warned about the safety of public Wi-Fi. Here’s how you can stay safe while traveling:
Use your own phone’s hotspot instead of using the public Wi‑Fi. A mobile connection, especially with an eSIM and a reputable carrier, significantly reduces the likelihood of an attack compared to an unknown hotel network.
If you’re forced to use public Wi‑Fi, use a VPN with an active Kill Switch: Complete the authentication on the hotel portal first, then launch your VPN before opening any website or app. The Kill Switch feature will instantly block all internet traffic if the VPN disconnects even for a second, preventing cybercriminals from injecting malicious code out in the open. While CaptiveCrunch operates around captive portals and pre‑VPN flows, a VPN still reduces other risks and limits passive data collection once you’re online.
Always inspect the certificate of any public Wi‑Fi login or ‘security’ portal that asks for more than a room number or basic credentials. These aren’t always a straight‑up giveaway, but sometimes they can be an obvious clue: mismatched hostnames, untrusted issuers, or plain HTTP are red flags that should stop you from proceeding.
Many captive portals ask for an email address for registration or marketing. Even in benign cases, there is little value in handing over your real inbox. If you must provide an address, consider giving a fake one or a throwaway alias that is unrelated to your primary accounts.
If you are asked to download software, a certificate, a browser update, or a fix tool in order to connect, stop. You should never have to download anything just to log into Wi‑Fi.
Don’t rush to follow instructions on a webpage or prompt, especially if it asks you to run commands on your device or copy-paste code. Be cautious of pages urging immediate action: sophisticated ClickFix pages add countdowns, user counters, or other pressure tactics to make you act quickly.
Secure your devices. Use an up-to-date, real-time anti-malware solution with a web protection component.
Avoid entering Microsoft 365, Google Workspace, or other high‑value credentials directly into any page reached via captive portal redirection. If you need to check corporate mail, follow known URLs rather than clicking through prompts.
And last but not least, update your browser, operating systems, and other important software before you travel. That reduces the chance of getting legitimate update requests while you’re away.
From reporting threats to removing them.
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
A scam is spreading through WhatsApp with the goal of taking over victims’ accounts entirely.
It starts with a message that feels harmless and familiar. Someone—often a contact whose account has already been compromised—asks you to support a friend or relative of theirs by voting in an online contest. The theme varies: a ballet performance, a dog competition, a school event. The wording is casual, sometimes urgent, and designed to get a quick click.
We spotted the scam showing up in our anonymized Scam Guard submissions. WhatsApp is popular with cybercriminals, and the third most common channel where we see scams delivered, behind websites and email.
At first glance, nothing seems out of the ordinary. But the link doesn’t lead to a real voting page. Instead, it redirects to a page that appears to be related to WhatsApp, often involving the legitimate wa.me domain, where the real attack begins.
This scam works because it combines trust and curiosity. If the message comes from someone you know, you’re far less likely to question it and far more likely to follow through to do them a small favor.
In some versions of the scam, the link redirects you into a flow that abuses WhatsApp’s legitimate “Linked devices” feature.
Depending on your device, you may see what looks like a WhatsApp page prompting you to continue, verify, or connect. In some cases, the victim is guided through steps that resemble setting up WhatsApp Web or linking a new device.
The goal is to trick you into authorizing a new linked session that gives the attacker access to your WhatsApp account.
A typical flow looks like this:
You tap the “vote” link.
A page opens that appears to be related to WhatsApp.
You’re prompted to complete a connection or verification step.
That action links your WhatsApp account to a device controlled by the attacker.
Some versions of this scam take a less direct route. Instead of sending victims to a fake voting page, the message or the landing page instructs victims to open WhatsApp, go to “Connected Devices,” and enter a code supplied by the scammer.
These scammers aren’t trying to steal your password. Instead, they’re tricking you into giving them access to your account yourself.
How WhatsApp’s Linked devices feature works
WhatsApp allows you to use your account on multiple devices, including a web browser or desktop app, through its Linked devices feature.
Normally, this works by:
Opening WhatsApp on your phone.
Scanning a QR code displayed on another device.
Approving the connection.
Once linked, that secondary device can:
Read your messages.
Send messages as you.
Access your ongoing conversations in near real time.
But if you follow those steps, you could be giving an attacker access to your messages, contacts, and ongoing conversations.
This is a legitimate and widely used feature, especially for WhatsApp Web. But in this scam, attackers abuse it to gain the same level of access without your informed consent.
Once a scammer links their device to your WhatsApp account, they can continue accessing your conversations until that device is removed.
From there, they can:
Send messages pretending to be you, including forwarding the same scam to your contacts.
Ask friends or family for money or sensitive information.
Read your chats and harvest personal information.
Because this doesn’t involve a traditional login, there are no obvious signs like password reset emails or failed login alerts. The attacker’s device simply appears as another linked session on your account.
Unless you check your linked devices, the compromise can go unnoticed for quite some time.
How to stay safe
Scams like this rely on quick reactions and misplaced trust. A few simple precautions can make a big difference:
Be cautious with unexpected “vote” or “support” requests, even if they come from someone you know.
Don’t click unexpected links, especially if you’re immediately asked to verify, connect, or link your WhatsApp account.
Never follow instructions to link devices or scan QR codes unless you initiated the action yourself.
Regularly review your linked devices in WhatsApp (Settings > Linked devices) and log out of any you don’t recognize.
If a message feels off, verify it with the sender through another channel before acting.
Malwarebytes Scam Guard can also help spot scams like this. It’s included with the Malwarebytes Mobile Security app for Android and iPhone.
If you suspect your account has already been compromised, immediately log out of all linked devices and warn your contacts so they don’t fall for follow-up scams.
Indicators of Compromise (IOCs)
These domains are typically short-lived and quickly replaced. However, they may help you recognize similar scams if you encounter them:
Search for certain combinations of “TikTok” and adult content, and sooner or later you’ll land on a page promising exactly what you searched for: an endless feed of explicit clips, no signup required, just tap and watch.
There isn’t one.
On the other side of that click is an ad funnel dressed up as exclusive content.
These pages aren’t connected to TikTok itself. They simply exploit the platform’s name to attract search traffic. TikTok’s huge user base, and the number of people searching for adult content associated with the platform, make it an attractive lure both for advertisers and scammers.
What you need to know right away
Nothing on these pages is genuine content pulled from TikTok. Their entire business model is get you to click, sign up, or install something.
The operators don’t need to host any videos to make money. The promise of exclusive content is enough to generate clicks, signups, and downloads.
Although you’re probably not going to lose your life savings here, you could well end up on a spam list, installing an unwanted app, or paying for an “age verification” that doesn’t verify anything.
A pitch built around your search
These pages are designed to match exactly what you searched for. Many are built to rank for popular search terms in Google and other search engines, rather than relying on visitors coming from TikTok itself. They often acknowledge the frustrating hunt for working links before presenting themselves as the solution.
Below that, you’ll usually find a deliberately blurred video thumbnail, reassuring labels like “18+ only” and “HD clips,” and one or two buttons inviting you to Start watching or Sign up for free.
Mirroring the visitor’s own search behavior back at them is a common tactic in this category of ad-lure page. It’s designed to make the offer feel more relevant rather than generic.
What happens after you click varies from site to site, but you rarely get the content you were promised. Instead, you’re likely to be redirected through advertising networks, asked to hand over an email address or payment card for “age verification,” or prompted to install an app from outside the official app stores.
Each click or redirect can earn the site operator money through advertising or affiliate commissions, even if you never sign up or download anything.
Every step of the journey has value: A click can generate advertising revenue, a signup can earn an affiliate commission, and an email address can be sold or added to marketing lists. A payment card entered for “age verification” can lead to recurring subscription charges. Whether you ever see a video is irrelevant because the site has already achieved its goal.
Legitimate websites don’t normally need your payment card to prove you’re over 18. Fake “age verification” pages often use the process to collect card details, sign people up for recurring subscriptions, or both.
There’s no content, but there is a funnel
The blurred thumbnail is the entire “product.” It’s designed to look like a legitimate preview, suggesting there’s something just behind the next click, even though there usually isn’t. The site makes money from the clicks, signups, and downloads, not from any videos.
Depending on the page, the operator makes money in several ways:
Affiliate commissions. You click through to a dating site, adult subscription, VPN, app, or other offer. If you sign up, the site owner gets paid.
Advertising revenue. Every redirect, pop-up, or ad impression earns money.
Lead generation. Your email address is collected and sold or used for spam and phishing.
Subscription traps. “Age verification” asks for a payment card, then quietly enrolls you in a recurring subscription.
Potential malware. Some pages push unwanted software or even malware outside official app stores.
Why this lure works
Adult content lures carry a built-in advantage most scams don’t have: embarrassment. People are less likely to mention it to a friend, ask for a second opinion, or report it, which means fewer eyes catch the scam before it spreads further.
What to do
Close the tab. There isn’t any exclusive TikTok content waiting behind Start watching.
Don’t enter your email address, payment card, or date of birth to verify access. It isn’t verifying anything, it’s collecting data.
Don’t install anything you were prompted to download from a page like this.
If you’ve already entered information, treat it as exposed. Watch for follow-up spam or phishing emails, and change any passwords you may have reused.
Adult-content lures are one of the oldest tricks in malvertising. Using TikTok’s name just makes them feel more relevant to today’s searches.
Something feel off? Check it before you click.
Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.
Fortnite scam pages like the ones below appear by the dozen every day, recycled endlessly under different names and designs.
One version promises $50 from a fake superhero collaboration. Another claims it can calculate what your locker is worth. Both lead to the same destination: a fake Epic Games login page designed to steal your account. It’s an old trick, but it still catches people out.
The short version
If a website promises free V-Bucks, cash, or a tool to calculate your locker’s value, then asks you to log in with your Epic account to get it, it’s not run by Epic.
Epic doesn’t offer an official tool that values accounts, and no legitimate giveaway requires you to sign in through a third-party site. You’re just handing your Epic username and password to scammers.
If you or your child entered your Epic login details on one of these sites, assume the account has been compromised. Change the password immediately, turn on two-factor authentication, and don’t reuse that password on any other accounts.
Why do they want your login?
A stolen Fortnite account can be worth real money. Criminals can take over accounts with rare skins, spend any saved payment methods, sell the account on underground marketplaces, or use it to scam the owner’s friends. They may also try the same username and password on other online accounts, hoping the password has been reused.
Why Fortnite?
Fortnite still attracts around 110 million monthly players and has more than 650 million registered accounts. That alone makes it an attractive target for cybercriminals.
The audience’s age matters too. In December 2022, the US Federal Trade Commission (FTC) fined Epic Games a record $520 million, after alleging that the company knew children made up a substantial share of its player base and left voice and text chat turned on by default, exposing them to strangers. The Consumer Financial Protection Bureau (CFPB) also cites industry experts who say young gamers are especially vulnerable to phishing because they spend more time on social media and are less familiar with social engineering.
The game is also built around visible status. Skins, emotes, and pickaxes cost real money, making the idea that “your locker has a price” feel plausible. Rare or discontinued skins really do sell for hundreds of dollars on unofficial marketplaces, even though Epic offers no official way to cash out V-Bucks and selling accounts violates its terms of service. That kernel of truth is exactly what these locker-value scams exploit.
That’s also what makes them more convincing than a simple V-Bucks giveaway. Instead of promising something for nothing, they play on curiosity about something the player already owns. That’s probably why this version keeps coming back.
How the scam works
Some pages promise rewards:
Others skip the free-reward pitch and frame the locker itself as hidden value the player is owed:
Others frame it as competition instead of currency:
The hook changes, but the fake login page doesn’t. These sites all do the same thing. They ask you to sign in with your Epic account so they can steal your username and password.
Another variant: Fake settlement claims
This one borrows a real story. Epic did settle with the FTC for $520 million, and real payments are still going out in 2026. But the real settlement pays actual dollars through the FTC’s own process, not in-game V-Bucks through an “Epic Games Locker,” and the claim window closed in July 2025.
References to an “EU Regulatory Mandate” and the case number shown on these pages don’t match any genuine legal action.
How to stay safe
Fortnite scams change constantly, but the advice doesn’t.
Use Malwarebytes Browser Guard to block known phishing sites before they have a chance to steal your login details.
Only sign in to your Epic account at epicgames.com. If another website asks for your Epic login, leave.
Be sceptical of offers that sound too good to be true. Free V-Bucks, locker valuations, and surprise rewards are all common phishing lures.
Verify refunds and settlements on the official source. If a page claims you’re owed money, check the regulator’s website yourself instead of following its links.
Turn on two-factor authentication (2FA). It can stop attackers from accessing your account even if they steal your password.
Use Malwarebytes Scam Guard. It can help you identify suspicious links and messages before you click.
What to do if you clicked
Change the Epic password immediately, going directly to epicgames.com, not through the suspicious link.
Turn on two-factor authentication if you haven’t already.
Check your linked email for password reset requests or login alerts you didn’t make.
Review connected devices/services on the account and remove anything unfamiliar.
If you entered payment details anywhere, contact your card issuer and monitor your statements.
Report the page to Epic’s support and flag it as phishing in your browser.
If the page claims to be part of a settlement or refund, verify it on the regulator’s official website. For the Epic settlement, that’s ftc.gov.
Stop threats before they can do any harm.
Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →
Researchers have described a campaign that delivers a remote access Trojan (RAT) called AtlasRAT through a fake Flash Player installer.
People still go looking for “Flash player” because a surprising amount of content and software was built around Flash and never properly migrated. Users often just want a quick way to get those old sites, games, or business apps working again.
The underlying problem is that Adobe ended support for Flash Player on December 31, 2020, and actively blocks Flash content from running in the official player.
Attackers know some people will still search for Flash to run a game or a business app, so they wrap their malware in a fake Flash‑related installer that looks familiar and legitimate.
That’s likely why the AtlasRAT infection chain starts with a Delphi executable named FlashPlay.Exe, masquerading as an “AGE Flash Player” installer. The first-stage loader runs entirely in memory and reconstructs additional payloads instead of dropping obvious files to disk, a technique often referred to as fileless malware.
The final payload (MainDll.Dll) uses a self‑signed certificate spoofing CN=update.Microsoft.Com to initialize Transport Layer Security (TLS) client communication and encrypts Command and Control (C2) traffic.
A self‑signed certificate means the owner signs with their own key instead of a trusted certificate authority (CA). That means an attacker can create a certificate claiming to be update.microsoft.com or google.com, even though they don’t control those domains. A web browser would reject such a certificate with a warning. Custom malware, however, can simply ignore the operating system’s trust checks and use it to set up encrypted C2.
Once AtlasRAT is installed, the operator gains long‑term remote control of the infected Windows system with capabilities including:
Collecting credentials via offline keylogging
Gathering system information and identifying installed security products
Exfiltrating data over encrypted channels
Injecting DLLs into applications like WeChat, potentially allowing the attacker to monitor or manipulate messaging, or to hide malware activity or connectivity.
Based on historical data, the researchers suspect that AtlasRAT is a reusable framework or commercial offering rather than a one-off tool used by a single group.
How to stay safe
When looking for apps and software to perform a specific task, remember that cybercriminals often exploit popular searches in semi-targeted attacks. In previous campaigns, for example, AtlasRAT has also been distributed as a fake VPN installer.
Some tips to keep this RAT, and others, off your computer:
Carefully check what you’re about to install. Sponsored search results are not a guarantee that software is legitimate.
A whole industry has sprung up around selling TikTok “growth.”
Cheap views by the hundred, pre-made ad accounts, and polished sales pages promising a repeatable path to serious revenue.
None of it is officially sanctioned by TikTok, and depending on what you’re buying, you could end up wasting money, losing your account, or handing your login details to scammers.
Scam 1: Sites selling cheap likes and engagement
Sites selling bulk engagement all look remarkably similar.
They offer small bundles of views, likes, or followers for a few pounds, usually alongside identical packages for YouTube, Instagram, and other platforms.
The sales pitch is almost always the same: “100% real profiles,” “no bots, no click farms,” and “completely safe.”
Those claims are worth reading carefully because they’re addressing the biggest concern buyers already have.
At this price point, bulk engagement is usually generated through bots, click farms, or other artificial means—the very thing these sites insist they don’t use.
Even if your engagement numbers increase initially, TikTok’s fraud detection systems can remove artificial engagement, and accounts that repeatedly use these services risk being flagged or restricted.
Scam 2: The “aged” ad account marketplace
Another common offer is bulk TikTok Ads accounts sold as “aged” or “trusted,” often bundled with a replacement guarantee if an account stops working. The pitch is that you skip the hassle of setting up and verifying a new advertising account.
The problem is that you don’t know how those accounts were created. Many are built using stolen or synthetic identities, compromised payment details, or other deceptive methods. Buying one means inheriting that history—and the very real risk that TikTok detects it and suspends the account, along with any campaigns or ad budget attached to it. A replacement guarantee won’t help if your advertising is suddenly brought to a halt.
Scam 3: The growth framework
A third type of offer is less obviously a scam and more of a marketing funnel.
Slick landing pages—often hosted on free platforms and paired with an embedded video—promise a “proven blueprint” for turning TikTok into a major source of income, usually backed by impressive but unverifiable claims about past clients.
The immediate goal is usually to collect your email address, and sometimes your phone number, before revealing what’s actually for sale. That might be a paid course, a “done-for-you” management service, or a request for direct access to your TikTok Shop or Ads account.
What happens next varies, but the common thread is the same: you’re being asked to trust an unverified third party with your business, your money, or your account.
What you’re really signing up for
Not every TikTok marketing service is a scam. But if someone’s offering thousands of views for a few pounds, bulk “aged” ad accounts, or guaranteed growth, you’re in a very different part of the market.
These services promise shortcuts. What they often deliver is fake engagement, accounts with questionable histories, or requests for access to your own account.
At best, you’ve wasted your money on engagement TikTok later strips away. At worst, you’re buying an account built on stolen information or giving an untrusted third party full access to your own.
Our advice
Don’t pay for views, likes, or followers. Artificial engagement isn’t real growth and can put your account at risk under TikTok’s rules.
Never share your TikTok username and password with a “boosting” service, regardless of how it’s presented.
Don’t buy or sell TikTok Ads or Business accounts outside TikTok’s own account creation process.
Treat “guaranteed revenue” frameworks and courses like any other business opportunity: they’re sales pages first, educational content second.
None of this is unique to TikTok. The platform’s explosive growth has simply given a familiar ecosystem of low-effort scams a new audience.
Scammers don’t need to hack you. They just need you to click once.
Shoppers browsing on their phones are landing on convincing Walmart lookalike sites offering name-brand liquor at 40% to 70% off, only to be led straight to a checkout page asking for a full credit card number, expiry date, and CVV.
The sites have no connection to Walmart. They’re part of a network of more than 120 near-identical domains built to look like a legitimate retailer just long enough to steal your card details.
Fake Walmart websites
The name “Walmart” is doing most of the work here. It’s one of the most recognized retailers in the world, and it’s that familiarity that makes people lower their guard. A shopper who’d hesitate on an unfamiliar website may think nothing of an unusually large discount because the logo, colours, and layout look familiar.
That trust hasn’t been earned by the site. It’s borrowed from a brand that has nothing to do with it.
If you’ve entered your card details on one of these pages, the safest assumption is that your card has been compromised.
How the scam works
The scam follows a simple pattern: a Walmart-branded homepage, category pages stacked with heavily discounted liquor, and a checkout form asking for full card details.
The discounts do much of the persuading. Seeing premium brands advertised at 60% or 70% off encourages people to buy first and ask questions later.
The same WordPress/WooCommerce template powers every site in the network. They share the same product catalogue, prices, and images. The only differences are fabricated US business addresses and phone numbers that are swapped out for each domain.
How to avoid this scam
Be sceptical of discounts that don’t match a retailer’s usual promotions, especially on liquor or electronics.
Check the address bar before entering payment details. A genuine Walmart sale won’t send you to an unfamiliar .shop domain.
Use tools that can identify scam websites automatically, such as Malwarebytes Browser Guard on desktop, or ask Scam Guard if it thinks a domain is suspicious.
On mobile, where these sites are designed to work, Malwarebytes Mobile Security can block known phishing and scam domains before you reach the checkout.
If you already entered your card details
Contact your card issuer immediately. Explain what happened and ask whether the card should be cancelled and replaced.
Watch your account for unauthorized charges, including small “test” transactions.
Report the domain through your browser’s phishing reporting feature and to the FTC at reportfraud.ftc.gov if you’re in the US.
The simplest defence is also the most effective: if a retailer needs a lookalike domain to sell you something, it’s probably a scam.
Call of Duty Mobile players should watch out for a phishing campaign disguised as a free Call of Duty Points giveaway.
Victims are asked to log in with their email address and password to claim free Call of Duty Points (CP), the game’s premium currency. They’re then redirected to a second page asking for their two-factor authentication (2FA) code.
The site has no connection to Activision. Its only purpose is to steal the login details needed to take over accounts.
Why Call of Duty Mobile accounts are worth stealing
Call of Duty Mobile has been downloaded an estimated 489 million times worldwide and has generated around $1.8 billion in lifetime in-app purchases.
An Activision account can be valuable for more than just the in-game currency it contains. Many players link their Activision account to Xbox, PlayStation, or Battle.net, meaning a stolen login could expose:
Stored payment methods
Purchase history
Other linked gaming accounts
How the scam works
The first page mimics the official Call of Duty Mobile site and offers 10,800 free points in exchange for an email address and password—not a redemption code, but a full account login. It also claims the reward will be “confirmed” within four to eight hours, buying time before anyone notices nothing has arrived.
There are warning signs, though. The page says “GET FREE POINT” instead of “GET FREE POINTS,” contains awkwardly worded instructions, and includes a live chat widget that appears to exist solely to make the site look more legitimate.
The redirect follows a common phishing technique known as a real-time credential relay. Instead of storing stolen usernames and passwords for later, the phishing site immediately submits them to the real Activision login page. That can trigger a genuine two-factor authentication (2FA) code, which the second page is designed to capture before it expires.
The victim ends up handing over everything needed to access their real account: their password and the one-time code that’s supposed to keep attackers out.
How to avoid this scam
Check the address bar. Legitimate promotions don’t ask you to sign in through an unfamiliar website.
Don’t let countdown timers rush you. They’re designed to make you act before you think.
If you’re unsure whether a promotion is genuine, open the official Call of Duty Mobile app or visit Activision’s website yourself instead of following a link.
If you play on your phone, Malwarebytes Mobile Security adds another layer of protection by helping block phishing sites and other mobile threats.
If you already entered your details
Change your Activision password immediately.
If you entered a 2FA code, assume someone may have accessed your account. Check your account activity and sign out of all devices.
Review any linked payment methods for unauthorized purchases.
The simplest way to avoid phishing attacks like this is to reach websites yourself by typing the address into your browser or using the official app, rather than following links from messages, social media posts, or ads.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
ClickLock Stealer is a new, modular macOS infostealer delivered via ClickFix-style phishing pages that can lock a victim’s Mac, steal their macOS password, browser and password manager data, cryptocurrency wallets, and then leave behind a persistent backdoor.
The malware was discovered by Group-IB researchers. They named it after the ClickFix distribution technique and its ability to lock a victim’s Mac if they don’t follow its instructions by killing all visible processes.
The researchers found a malicious shell script typically used to trick users into infecting their own device and followed the trail from there. The script first displays a fake Cloudflare progress bar, suggesting it was intended to be used as part of a fake browser verification flow.
Victims land on a phishing page that mimics Cloudflare verification or another fake system utility, similar to those used in the Infiniti Stealer campaign, and later ClickFix attacks impersonating Claude or cleanup utilities.
The page instructs the user to open Terminal, paste a command, and press Return, presenting it as a required “human verification” step or a quick fix.
The researchers explain:
“the malware orchestrates further modules that search the system for various data including browser credentials, password manager data, crypto wallet extensions, desktop wallet files, etc. and even employs a GSocket backdoor.”
This all happens while the user is distracted by fake Cloudflare images.
A GSocket backdoor abuses GSocket (short for Global Socket), an open-source networking toolkit. While designed for legitimate remote administration and penetration testing, attackers can weaponize it to establish stealthy, persistent, encrypted remote access to compromised systems.
Forcing victims to hand over their password
What really stands out is the way the malware forces the user to provide their macOS system’s password.
First, it displays a convincing fake macOS password prompt using the victim’s real username and a downloaded Apple icon. If the user enters their password, it is sent, along with all the previously stolen data, to a Telegram channel controlled by the attackers.
If the user refuses, the malware triggers a loop that shuts down key processes, including Finder, Dock, Terminal, Activity Monitor, Console, System Settings, Spotlight, and all major web browsers. It leaves only a password dialog on the screen until the victim complies.
This “kill loop” runs every 210 milliseconds for up to 83 hours, or until the user enters the correct password. The result is a system that’s essentially unusable, with the password prompt becoming the only interactive element.
Once the stolen data has been sent to the Telegram channel, the malware starts deleting its own modules. However, unlike the infostealer modules, the GSocket backdoor remains installed, giving the attacker ongoing remote access to the system.
That means attackers can return later, even after the stealer components have self‑deleted, to install new malware, steal more data, or move through a corporate network using VPNs or SSH access already available on the compromised Mac.
With ClickFix running rampant and inventing new methods all the time, it’s important to stay aware, think twice before following unexpected instructions, and keep your devices protected.
Slow down. Don’t rush to follow instructions on a webpage or prompt, especially if it asks you to run commands on your device or copy and paste code. Attackers rely on urgency to bypass your critical thinking.
Avoid running commands or scripts from untrusted sources. Never run code or commands copied from websites, emails, or messages unless you trust the source and understand what the action does.
Verify instructions independently. If a website tells you to execute a command or perform a technical action, check through official documentation or contact support before proceeding.
Limit copy and paste for commands. Manually typing commands instead of copy and paste can reduce the risk of unknowingly running malicious payloads hidden in copied text.
Secure your devices. Use an up-to-date, real-time anti-malware solution with web protection. Malwarebytes blocks connections to unsafe sites like these.
Educate yourself on evolving attack techniques. Understanding that attacks may come from unexpected places helps maintain vigilance. Keep reading our blog!
Stay away from sponsored ads in search results. Anyone can buy them and make them look legitimate.
Pro tip: The free Malwarebytes Browser Guard extension warns you when a website tries to copy something to your clipboard.
Malwarebytes products detect and block ClickLock as MacOS.Stealer.ClickLock.
From reporting threats to removing them.
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
Christopher Nolan’s The Odyssey is one of the biggest movie releases of the year and scammers wasted no time taking advantage of it. Within hours of the film’s release, we found scams targeting people looking for pirated copies. Some used fake browser warnings on piracy sites, while others disguised malware as movie downloads.
Some used fake browser error messages designed to funnel people through malvertising networks. Others offered what appeared to be movie downloads that were actually Windows executables disguised as video files.
Neither scam has anything to do with the movie itself. They’re simply taking advantage of people searching for a popular new release.
The Odyssey piracy scams we found
We observed two main tactics.
One used fake pop-ups claiming your browser was missing a required “component.” Clicking Fix It Now didn’t solve any problem. It simply routed visitors into a malvertising network. Exactly where those redirects ended depended on whatever campaign the network was serving at the time.
The second involved a file advertised as The Odyssey 2026 1080p WEBRip-LAMA. Once downloaded, however, it turned out to be an .exe file. That’s a Windows application, not a video.
Movies don’t need to run as programs. If a supposed movie download ends in .exe, it isn’t a movie.
The fake “Browser Issue Detected” warning
On cloned piracy sites listing The Odyssey torrents, we encountered a fake browser pop-up claiming Browser Issue Detected. It warned that a “missing component” was preventing full access. It presented a prominent Fix It Now button, with a much smaller Close and Continue Browsing option underneath.
There was no missing browser component. The entire pop-up was part of the webpage itself, designed to look like a genuine browser warning.
What made this particularly interesting was how consistently it appeared. We found the same overlay—identical wording, identical layout, with only the branding colors changed—across multiple cloned torrent sites.
These were not the genuine torrent trackers, but convincing copies designed to impersonate well-known piracy sites that reproduced real listing layouts, artwork, and cast information for The Odyssey, then displayed the fake browser warning on top. Taken together, the cloned websites and identical pop-ups strongly suggest a coordinated campaign built to capture searches for a major new release, rather than legitimate torrent sites that had been compromised.
Clicking Fix It Now typically sends visitors through one or more advertising redirects. Depending on which campaign is active at that moment, users may eventually land on:
A fake browser extension
Scareware urging them to call a fake technical support number
Another redirect attempting to deliver malware
The final destination can vary from one visit to the next because the underlying ad network changes what it serves over time.
A movie that was actually a program
The second scam targeted people who actually tried to download the movie. We also found a listing named The Odyssey 2026 1080p WEBRip-LAMA.exe, advertised as a 1080pWEBRip release with 597 seeders and 520 leechers.
Windows immediately identified the download as an Application, confirming what the file extension had already revealed.
Legitimate movie downloads use video containers such as .mkv, .mp4, or .avi. These files are opened by a media player, they do not execute code.
Several other details stood out.
The file description read “wireless bus Business Controller,” which has nothing to do with video playback and was likely leftover metadata from whatever software was originally used to build the executable.
The file also displayed VLC Media Player’s familiar orange traffic cone icon, despite being an application rather than a video file. That’s a classic social engineering trick. VLC is one of the world’s most widely used media players, so many people instinctively associate its icon with a harmless video. In a downloads folder, the file looks like something you can safely double-click when, in reality, doing so executes an unknown program with your own user permissions.
Files packaged this way (with misleading extensions, spoofed icons, and inconsistent metadata) are a well-established malware delivery technique.
What runs after the user launches the file depends on the campaign. It could be:
A Trojan that opens a backdoor into the system
An infostealer that steals saved passwords and browser sessions
A loader that downloads additional malware
In some cases, ransomware
It’s also worth remembering that large numbers of seeders don’t prove a file is safe. They only indicate that many people are sharing it, and plenty of people unknowingly distribute malicious files.
Why these scams work
Neither scam relied on exploiting a software vulnerability.
Instead, both relied on convincing someone to take the next step: clicking a fake browser warning or running what they believed was a movie.
That’s much harder for security software to prevent completely, because browsers can’t reliably distinguish between a genuine browser message and one rendered entirely in a webpage’s HTML. Likewise, antivirus software can’t flag every executable simply because it uses a misleading icon or contains unusual metadata, as many legitimate applications do too.
Security software still plays an important role. It can block known malicious websites, detect malware after it’s identified, and stop many malicious downloads or redirects before they complete.
But recognizing that a “movie” ending in .exe is never really a movie remains one of the simplest and most effective security checks users can make themselves.
What to do if you may have been affected
If you clicked Fix It Now and something unexpected downloaded or opened afterward, run a full Malwarebytes scan.
If you ran a supposed movie that turned out to be an .exe, disconnect the computer from the network, perform a full malware scan, and avoid using the device for banking, email, or other sensitive accounts until you’re confident it’s clean.
Check your browser for extensions you don’t remember installing and remove anything unfamiliar.
If you executed an unknown program, change passwords for important accounts from a separate, trusted device.
Treat any pirated “movie” that isn’t a standard video format as suspicious. There is no legitimate reason for a movie download to be a Windows application.
Closing thoughts
Piracy-adjacent malvertising and fake-movie droppers persist because they don’t need to be sophisticated. They only need a title popular enough to guarantee search traffic. A $250 million IMAX epic with a year of ticket pre-sales behind it is about as close to guaranteed traffic as the piracy economy gets, which is why these scams surfaced within hours of release day rather than weeks later.
If you’re downloading a film and it asks you to install something, fix your browser, or run an .exe, you’re almost certainly not getting a movie. You’re downloading software that could infect your computer.
Stop threats before they can do any harm.
Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →
We have detected several campaigns using fake downloads of games, mods, cracks, and software to spread RenPy Loader. Once installed, the loader starts a complex, multi-stage infection chain that abuses MSBuild and the EtherHiding technique before ultimately delivering Amatera Stealer.
Amatera is an infostealer—a type of malware designed to steal sensitive information from an infected device. It can target passwords and other data stored in browsers, cryptocurrency wallets, browser extensions, messaging apps, and local files. Stolen credentials and session data may also allow attackers to access the victim’s online accounts.
The victim may see what appears to be a normal game or software installer while the malware runs silently in the background.
RenPy Loader, also known as RenEngine Loader, is particularly interesting because it abuses Ren’Py, a legitimate engine used to create visual novels, story-driven games, and interactive fiction. By hiding malicious code inside software associated with gaming, attackers can make their downloads appear more believable to people looking for games, mods, or cracked software.
We’ve previously seen attackers misuse legitimate development tools and emerging software frameworks, including Bun and Deno, to distribute malware. RenPy Loader follows the same pattern: Attackers abuse legitimate technology to disguise malicious activity, complicate the infection chain, and make detection more difficult.
RenPy Loader has also been observed delivering other malware, including HijackLoader and Lumma Stealer, showing that the final payload can vary between campaigns.
In this blog, we analyze an infection chain in which Ren’Py decrypts a ZIP archive containing a BAT file and several MSBuild project files. These files load a trojanized .NET component, which then decodes another malicious component.
That malicious component uses a technique called EtherHiding to locate its command-and-control (C2) server. Instead of storing the C2 address directly inside the malware, the attackers hide it in data stored on a public blockchain. The malware then downloads the next stages of the attack from that server, making the attackers’ infrastructure more difficult to identify and disrupt.
Finally, we examine the additional payloads that ultimately decrypt and execute Amatera Stealer.
Fake downloads infect your device
The infection begins when someone downloads a supposed game, mod, crack, or piece of software. We found malicious files distributed through:
Malicious websites
Game download portals
Several file-sharing services, including Wormhole, GoFile, Google Drive, and MEGA
Here are some of the detected pages that start the infection chain:
In several cases, clicking a download link redirected the user to another fake download website. These pages used different designs and invented service names, helping the campaigns appear less repetitive and making the malicious infrastructure harder to recognize.
Below are examples of fake download pages used to distribute the malicious archive:
The user downloads an archive containing a file named Setup.exe. Opening this file starts the infection chain.
Example of an archive downloaded from a malicious website
The victim sees a loading or installation screen, but malicious code is running in the background.
The installation screen
How to stay safe
A few precautions can reduce the risk of downloading malicious games or software:
Download games and software from official websites, trusted app stores, or established distribution platforms.
Treat cracked software, unofficial mods, and free versions of paid games with caution.
Be wary when a download link redirects you through several unfamiliar websites or file-sharing services.
Check the contents of downloaded archives before opening executable files such as Setup.exe.
Look for unusual filenames, unrelated images or text files, and content that does not match what you intended to download.
Use real-time anti-malware software such as Malwarebytes.
Keep your operating system, browser, and security software up to date.
The people behind these campaigns continually create new websites and change their download pages. A professional-looking installer or familiar file-sharing service does not guarantee that a download is safe.
Technical analysis of RenPy loader
Ren’Py is a free, open-source engine for creating visual novels, story-driven games, and interactive fiction. Ren’Py allows the integration of Python scripts, which attackers abuse to insert malicious code.
In this case, we found malicious code in the following files and paths:
The first-stage loader extracted from libwin32.rpa performs the following operations:
Reads the config data/.GEg and decrypts it using Base64 decoding and XOR with the key 81034149cd6f48c8821340204f92766e. This config contains the password used to extract the ZIP, along with other configuration data used by the loader.
Calls sys_config.is_sandboxed() and exits if a sandbox is detected.
XOR-decrypts data/j3lpTcg7kBRN.E3 using the key A50YyY1 to obtain the ZIP.
Extracts the ZIP contents to a random folder under %TEMP%/tmp-{5 digits}-{12 characters} and writes a :Zone.Identifier alternate data stream (ADS) with ZoneId=0 to remove the Mark of the Web and bypass SmartScreen. It also inserts a random REM string into the extracted BAT file.
Launches the payload using forfiles.exe.
Sends the machine’s MAC address and campaign ID to a tracking website.
The decoded configThe files contained in the decrypted ZIP
In this case, the extracted BAT file was executed using the following command:
@echo off
setlocal DisableDelayedExpansion
set "_bp=%~f0"
set "_rl=0"
if /i "%~1"=="/launched" set "_rl=1"
if /i "%~2"=="/launched" set "_rl=1"
if /i "%~3"=="/launched" set "_rl=1"
if /i "%~4"=="/launched" set "_rl=1"
if /i "%~5"=="/launched" set "_rl=1"
if /i "%~6"=="/launched" set "_rl=1"
if /i "%~7"=="/launched" set "_rl=1"
if /i "%~8"=="/launched" set "_rl=1"
if /i "%~9"=="/launched" set "_rl=1"
if "%_rl%"=="1" goto :_go
set "_ch=%SystemRoot%\System32\conhost.exe"
if exist "%SystemRoot%\Sysnative\conhost.exe" set "_ch=%SystemRoot%\Sysnative\conhost.exe"
where conhost.exe >nul 2>&1
if %errorlevel% equ 0 (
endlocal & start "" /b "%_ch%" --headless cmd.exe /c "%_bp%" /launched
) else (
endlocal & cmd.exe /c "%_bp%" /launched
)
exit /b 0
:_go
endlocal
setlocal EnableExtensions
set MSBUILDENABLEALLPROPERTYFUNCTIONS=1
set "_czzf=%~dp0Nancy.csproj"
set "_pb=%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
REM b64c5053-f19f-4c80-8ac5-e1e3f55b1c1c
if not exist "%_pb%" set "_pb=%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
if not exist "%_pb%" (
exit /b 9
)
"%_pb%" "%~dp0Nancy.csproj" /nologo /v:q >nul 2>&1
endlocal
The executed BAT file performs the following operations:
Relaunches itself in a headless console when supported:
Enables MSBuild property functions, allowing additional methods such as AppDomain.CurrentDomain.Load to be executed:
MSBUILDENABLEALLPROPERTYFUNCTIONS=1
Executes MSBuild.exe with Nancy.csproj as its project file. During project evaluation, a malicious MSBuild property function hex-decodes and reflectively loads the next DLL stage.
The trojanized Nancy DLL and custom bytecode
Nancy.csproj imports the three extracted files Nancy.csproj.user, Internal.props, and Nancy.Compile.targets. The malicious DLL is split across three values stored in these files.
The imported files inside Nancy.csproj
Nancy.Compile.targets concatenates the three values to hex-decode the DLL and execute the DefaultEvaluator5 method using AppDomain.CurrentDomain.Load.CreateInstance.
Execution of DefaultEvaluator5
The interesting part is that Nancy.csproj serves two purposes: It is the MSBuild project used to execute the first-stage loader, and it also contains the next stage decoded by the loader.
The DLL is a trojanized version of the Nancy .NET library and is an obfuscated .NET loader with malicious code implemented in the DefaultEvaluator5 class. Some of the DLL’s functionality is implemented in custom bytecode executed by this main method.
Comparison between the legitimate and trojanized Nancy DLLs
The DLL performs the following operations:
Decrypts strings from resources using multi-key XOR decryption.
Resolves APIs using API hashing and GetDelegateForFunctionPointer.
Changes network settings, including disabling TLS certificate validation and setting the default system proxy.
Performs anti-forensics operations.
Reads the _czzf environment variable, which points to the previous Nancy.csproj file, then decodes and executes it.
The main DefaultEvaluator5 method retrieves strings and interprets the bytecode contained in the following resources:
Nancy.Runtime.mvlorimu: Contains the custom bytecode. The bytecode is interpreted by _pv and _sro. It implements 23 opcodes used to decrypt other strings and load the next-stage DLL.
Nancy.Data.tcnlhxw and Nancy.Resources.kxxodp: Contain the encrypted strings and other data used for decryption, including keys, lengths, indexes, and the S-box.
The strings are decrypted using the following algorithm:
The next DLL stage, GollopDevest, is decoded from the same Nancy.csproj file using the following logic and loaded with AppDomain.Load:
for i, k in enumerate(marker_int):
if k < 256:
payload[i] = k
else:
payload[i] = marker_int[k-256]
The encoded next stage between the Pack markers
EtherHiding and Amatera Stealer
The next extracted stage is a DLL called GollopDevest.dll, a .NET downloader that uses the EtherHiding technique to obtain its command-and-control (C2) server and download the next stage.
The encrypted C2 domain is obtained using an Ethereum JSON-RPC eth_call request to bsc-dataseed.binance.org:
This EtherHiding downloader is likely part of a malware-as-a-service (MaaS) operation, as we have detected it being distributed in other campaigns, including ClickFix campaigns.
Three additional payloads are then downloaded: two .NET DLLs called PavinWide (an anti-analysis DLL) and GollopDevest (a loader DLL), and a C++ DLL called LanoseThrip, which ultimately decrypts and loads Amatera Stealer.
In this case, these payloads were downloaded from:
/assets/ExponeAboard.json
/assets/MailersKogasin.json
/assets/LanoseThrip.json
The .NET DLLs are heavily obfuscated using control flow flattening, indirect calls through calli/ldftn, string encryption with several algorithms, junk code, dead code, and fake strings such as URL paths.
The analysis of these DLLs is still ongoing and will be explored in more detail in the next blog posts.
Indicators of Compromise (IOCs)
Domains
downpro[.]net – Fake download website
macisofile[.]sbs – Fake download website
visitmama[.]blog – Fake download website
visitmama[.]guru – Fake download website
getgamerfree[.]com – Fake download website
fullgames[.]digital – Fake download website
flingbase[.]net – Fake download website
citronemu[.]com – Fake download website
filemodo[.]xyz – Distribution infrastructure
storage06x[.]cfd – Distribution infrastructure
p03sil[.]cyou – Distribution infrastructure
wimsedas[.]xyz – Distribution infrastructure
againstmor[.]store – Distribution infrastructure
host03q[.]cfd – Distribution infrastructure
cloud01y[.]cfd – Distribution infrastructure
storage11x[.]cfd – Distribution infrastructure
storage04x[.]cfd – Distribution infrastructure
host82p[.]cfd – Distribution infrastructure
cloud05y[.]cfd – Distribution infrastructure
analyticstrack-pzh[.]click – Tracking website
login.orbitalframework[.]cc – Amatera Stealer C2
IP addresses
144.124.251[.]171 – Used to obtain additional payloads
195.63.140[.]33 – Used to obtain additional payloads
78.40.196[.]252 – Used to obtain additional payloads
CrashStealer is a new macOS infostealer that masquerades as Apple’s CrashReporter component, uses an Apple‑notarized installer to slip past Gatekeeper, tricks users into handing over their password, and then systematically loots browsers, password managers, crypto wallets, and Keychain secrets before exfiltrating them in AES‑encrypted bundles.
Researchers have been following the development of CrashStealer since May 2026. It impersonates Apple’s CrashReporter component by taking the name CrashReporter.app. It also creates a LaunchAgent named com.apple.crashreporter.helper and uses the legitimate tool’s icon and metadata to look as trustworthy as possible.
Gatekeeper, basically macOS’s bouncer at the door, checks whether an app looks safe before letting it run. By using a notarized installer—one that Apple has scanned and stamped as acceptable—Gatekeeper is more likely to let it through without raising alarms. Getting notarized doesn’t mean Apple intentionally approved the malware. It means the installer passed Apple’s automated checks, and the attackers abused that trust.
The notarized installer, called “Werkbit Setup” is distributed from a fake software site registered in late June and gated behind a meeting PIN (Personal Identification Number), suggesting a targeted, invitation‑only campaign.
When launched, the malware displays a fake macOS password prompt that users will expect to see when running a legitimate system operation requiring administrator privileges. In reality, the malware uses that password to unlock the user’s Keychain, which stores passwords and other sensitive data in macOS’s encrypted password vault.
Image courtesy of Jamf Labs
The malware then steals browser credentials and cookies, cryptocurrency wallet extensions, password manager data, and small files from common user directories. The stolen data is encrypted and sent to a command and control (C2) server.
CrashStealer is a reminder that macOS is firmly in the sights of credential‑stealing operations. Notarization and Gatekeeper reduce many classes of risk, but they do not remove the need for layered defenses, cautious user behavior, and ongoing threat monitoring.
How to stay safe
There are a few things you can do to protection yourself from CrashStealer and other infostealers.
Be skeptical of “CrashReporter” downloads. Apple’s crash‑reporting tools ship with macOS, so you should never need to download a separate CrashReporter app from a third‑party site.
Treat PIN‑gated installers with caution. If a meeting invite or collaboration tool requires you to download software from an unfamiliar domain and enter a private PIN to unlock the installer, verify the request with the organizer through a separate trusted channel.
Treat a password request that appears immediately after launching a new or unfamiliar app—especially one claiming to be a system component—as a red flag.
Separate your risk. Avoid keeping high‑value crypto wallets, password vaults, and everyday browsing credentials on the same machine and user profile wherever possible.
Malwarebytes detects CrashStealer as MacOS.Stealer.Crash.
We don’t just report on threats—we remove them
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
You want to turn some crypto into a gift card. You search, click a promising result, and land on a site that looks polished and legitimate: a dark theme, trust badges, and promises of instant delivery and no ID checks. You wouldn’t think to question it.
But a professional-looking website isn’t proof that it’s legitimate.
What’s going on
Crypto gift card sites are an easy category to fake.
Several legitimate platforms let people convert Bitcoin, Ethereum, and other cryptocurrencies into gift cards for major brands. They also tend to look similar: a dark theme, a bold “Pay with crypto” message, trust badges, and a grid of popular gift card deals.
That makes them easy to imitate.
Scammers build lookalike sites that copy the same design language and sometimes even use a name that’s only one or two letters different from a legitimate platform. They’re designed to be mistaken for the real thing by anyone scrolling quickly or clicking through from an ad or search result.
The pricing is part of the deception, too. A $100 Amazon gift card for $95. A $25 Steam Wallet code for $24. A $100 Netflix gift card for $92. Those discounts don’t look unrealistic, so the scam looks very convincing.
What’s the scam?
The simplest scam is non-delivery. You pay, and nothing arrives because there was never any gift card to send. The website exists solely to collect crypto payments.
Crypto payments generally can’t be reversed. There’s no bank to call and no chargeback if the gift card never arrives. Once your Bitcoin or Ethereum leaves your wallet, it’s usually gone. Some scams go a step further and send you a code. It just isn’t a legitimate one.
Stolen gift card numbers are bought and sold on cybercriminal marketplaces, often for a fraction of their face value because they’re likely to be drained or reported before they’re redeemed. A scam site can buy those codes cheaply, resell them at what looks like a reasonable discount, and leave you with a code that never works or stops working shortly after purchase.
Even if a stolen code works at first, buying it helps create demand for more stolen gift cards.
There’s another reason these sites attract criminals. Crypto gift cards are commonly used to launder stolen cryptocurrency. Converting crypto into gift cards, and gift cards into goods or account balances, makes transactions harder to trace. A fake storefront doesn’t just be steal from buyers, organized crime gangs also use it to move funds.
None of this requires advanced technical skills. A convincing storefront, irreversible crypto payments, and search or social media ads are often enough to lure victims.
How to protect yourself
Go directly to the platform’s official site by typing the address yourself, rather than clicking a link from an ad, a search result, or a message.
Check the spelling of the domain character by character. Scam sites often use domains that differ from a legitimate one by just one or two letters.
Don’t assume “No ID required” means a site is trustworthy. It’s a genuine feature on some platforms, but scammers use it too.
Think twice before clicking Connect Wallet. Depending on the permissions you approve, it can expose more than a single payment.
Be skeptical of discounted gift cards, even modest discounts. Small discounts are designed to look believable.
Search for the platform’s name plus “scam” or “reviews” before you pay, especially if you found the site through an ad.
Use a browser extension that blocks scam and phishing sites, such as Malwarebytes Browser Guard. It can flag a fake storefront before you land on it, even ones it hasn’t seen before.
If you’ve already sent crypto to a suspicious site
Treat the funds as unrecoverable, but act quickly anyway.
If you have the transaction ID, check a blockchain explorer to see whether the funds were sent to a known exchange. If they were, contact the exchange’s fraud team immediately.
If you connected your wallet rather than sending a payment, review and revoke any token approvals you granted.
Microsoft published new research on GigaWiper, a modular Golang backdoor for Windows that combines robust remote access with multiple ways to permanently destroy systems and data.
GigaWiper is a Windows backdoor that Microsoft has observed in intrusions since October 2025. Rather than being a single-purpose wiper, it’s an operational platform that blends command‑and‑control (C2), data destruction, and remote access options in a single piece of malware.
What’s remarkable is that GigaWiper seems to be built using previously separate tools like the Crucio ransomware and the FlockWiper disk wiper, wrapped into a consolidated framework.
Based on the characteristics of the malware, which include espionage features (screen capture, VNC‑like remote control, system inventory) and multiple ways to irreversibly destroy data, it fits the pattern of an attacker that wants long‑term access but also reserves the option to wipe systems if they choose.
GigaWiper implements about 20 commands, falling broadly into three categories: destruction, remote access/monitoring, and system management. Some examples include:
Raw disk wiper that overwrites raw disk content in large chunks before forcing an immediate reboot.
Fake ransomware (Crucio‑based) wiper that masquerades as ransomware. Instead of demanding payment, it encrypts files and then throws away the encryption key, making recovery impossible.
Windows drive secure wiper that targets the Windows installation drive and performs multi‑pass overwrites using different byte patterns.
Screen capture and recording, including one‑shot screenshots of each monitor and continuous recording while the user is active.
Remote control via a TCP (Transmission Control Protocol) server that streams the desktop and allows keyboard and mouse input after creating its own Windows Firewall exceptions.
GigaWiper also sets up a scheduled task called “OneDrive Update” that runs every minute and at startup to maintain persistence.
Command-and-control servers were found at 185.182.193[.]21 and 212.8.248[.]104.
Malwarebytes blocks the C2 connections
Its management utilities include process, service, and registry managers that can create, list, or kill processes, manage Windows services, and navigate and mutate registry keys. It also collects system information, including hardware, operating system, network, firmware, user, and antivirus details.
How to stay safe
Because GigaWiper is deployed after attackers have already compromised a system, the best defence is preventing the initial intrusion and detecting malicious activity before destructive commands can be executed.
Malwarebytes detects GigaWiper components with the detection names Trojan.FlockWiper and Backdoor.GigaWiper.
If GigaWiper is detected, disconnect the affected machine from the network immediately to prevent attackers from initiating destructive commands.
Enable tamper protection (or the equivalent feature in your security software) so local admins and malware cannot silently disable anti-malware or other security tools.
Monitor for connections to the known C2 servers, the creation of the “OneDrive Update” scheduled task, and unauthorized attempts to disable Windows recovery.
Finally, rotate credentials, particularly for any accounts that may have been compromised, and review logs for privilege escalations or lateral movement to determine if other systems have also been affected.
We don’t just report on threats—we remove them
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
Crypto prediction and betting sites are appearing around the World Cup, and researchers have already tracked scams aimed at fans, including fake ticketing, fixed-match betting, prediction scams, and fan-branded meme coins.
We investigated one prediction site ourselves. While we aren’t claiming every site works the same way, it matched several well-known scam patterns. Whether it’s a worthless token, a fake betting platform, or a disappearing website, the result is often the same: you lose money.
What you need to know
This isn’t a single scam. Different sites use different tactics, but many follow the same playbooks.
Even if a site pays out exactly what it promises, you could receive a token that’s difficult or impossible to sell.
Some sites simply keep your deposit and stop responding.
Crypto transactions generally can’t be reversed. Once you’ve sent the money, recovering it may be impossible.
A World Cup-themed crypto prediction site
How you lose money
The last three examples below are based on a token we investigated directly. The first two are common scam patterns seen across this category.
Pump-and-dump: A token is promoted through the game, early participants receive genuine payouts that build trust, then the creators sell their holdings and the price collapses. Later buyers are left with a token few people want.
Take the money and vanish: You deposit crypto to unlock betting or enter the game. The site keeps the money and disappears.
Fake free-to-play: The game is advertised as free, but you have to buy or hold a token before you can participate. The game attracts users; the token sale generates revenue.
Copycat naming: A new token uses a name similar to an established cryptocurrency, making it easier for people to mistake it for a legitimate project.
Manufactured activity: The same tokens move repeatedly through a central wallet, creating the appearance of trading activity. On charts, it can look like an active market when little genuine trading is taking place.
Traditional crypto advice doesn’t help much here
You’ve probably heard advice like “never share your seed phrase.” That’s still important, but it isn’t what’s happening here.
These sites don’t need access to your wallet or seed phrase. They persuade you to send money voluntarily. Once you’ve done that, there may be nothing to recover.
How to check a token
Look at how many people actually hold the token. A token with very few holders, despite lots of apparent trading, deserves extra scrutiny.
Just four holders, which is a major red flag for a supposedly active token
Check the transfer history, not just the trading volume. On one token we examined, identical amounts repeatedly moved into and back out of the same central wallet. We confirmed this pattern across more than a dozen addresses. Genuine market activity rarely produces repeated matching round trips like this.
Repeated transfers create the appearance of trading
Search the token name alongside “price.” If a similarly named cryptocurrency already exists, you may be looking at a copycat.
A copycat token on Pump.fun
Before sending money, ask yourself what happens if you never see it again. If you aren’t comfortable with that answer, don’t send it.
If you’ve already sent money
Don’t send more to unlock a refund or payout. That’s often part of the scam.
Assume the money may be gone. Waiting for the site to make things right rarely works.
Disconnect unfamiliar apps, then revoke any spending permissions you granted. Disconnecting a wallet from a site doesn’t necessarily revoke any spending approvals you’ve already granted. Check your wallet’s support pages for instructions on reviewing and revoking those permissions.
Report the scam to help protect others:
Report the website to your country’s cybercrime reporting service or consumer protection agency.
Report the wallet address if the wallet or exchange you use provides an abuse reporting option.
If you found the site through social media or a search engine, report the post or advert so it can be reviewed.
Whether the site pays you in a token that quickly becomes worthless or simply disappears with your deposit, the outcome can be much the same.
If a crypto prediction game asks you to buy or hold a token before you can play, stop and ask why. The game may be there to encourage token sales rather than reward successful predictions.
Stop threats before they can do any harm.
Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →
Blake McDermott is Senior Threat Hunter at Rapid7.
Every week, threat hunt teams are faced with a steady flow of blogs, advisories, and DFIR reports containing valuable intelligence about adversary behaviors, tactics, techniques, and procedures. The challenge is turning that intelligence into repeatable, behavior-based hunting logic quickly enough to be useful. Indicators of compromise still have value, but they age quickly. Behavioral detections give defenders a better way to look for how attackers operate, rather than relying only on what they leave behind.
To help solve this, Rapid7’s Internal Security team built an automated threat hunting pipeline that transforms threat intelligence reporting into structured, executable hunt plans. The pipeline uses large language models to extract adversary behaviors, map them to MITRE ATT&CK techniques, generate detection queries across multiple tools, and support analyst-ready briefings in minutes rather than days.
Why manual threat hunting does not scale
A single threat intelligence report can describe dozens of adversary behaviors across multiple ATT&CK techniques. Translating that report into useful hunt logic often requires an analyst to read the full source, identify relevant behaviors, map them to ATT&CK, write queries for each security tool, validate syntax, execute searches, and triage the results.
For a report covering 40 to 50 techniques, that process can consume much of a working week. When multiple high-quality reports land at once, manual hunting quickly becomes unsustainable. The goal of this project was to reduce the mechanical work involved in building hunt plans, while keeping analysts in control of validation, interpretation, and decision-making.
How the automated threat hunting pipeline works
The pipeline runs in four stages, each designed to be inspectable, repeatable, and easy for analysts to refine over time.
Stage 1: Threat intelligence ingestion
The pipeline accepts a threat intelligence blog or report via URL or pasted text. It extracts the core article body, removes navigation and boilerplate content, and validates the material to ensure there is enough substance for analysis. This creates a clean input for the model and reduces the risk of irrelevant page content influencing the output.
Stage 2: ATT&CK technique extraction
The cleaned content is then sent to a large language model with a structured prompt that instructs it to act as a MITRE ATT&CK analyst. The model identifies adversary techniques referenced in the report and returns each one with its technique ID, technique name, tactic category, and a short summary of how the threat actor used it.
The prompt is tuned to focus on offensive behaviors and adversary tradecraft. Defensive recommendations, control guidance, and mitigation strategies are excluded from this specific workflow so the output reflects what the attacker did, rather than what defenders should implement in response. That focus helps preserve the hunting value of the source material while leaving room for separate workflows that generate defensive recommendations or control improvements.
For example, when applied to a Rapid7 threat research report on BPFdoor activity in telecom networks, the pipeline identified 16 techniques across seven ATT&CK tactics, including Initial Access, Persistence, Defense Evasion, Credential Access, Collection, Command and Control, and Execution. That structured extraction became the foundation for a hunt plan with detection coverage across InsightIDR, Velociraptor, and Sigma, giving analysts a faster path from source intelligence to behavior-based hunting logic.
Stage 3: Detection query generation
For each identified technique, the pipeline generates detection content across several tools and formats. This includes LEQL queries for InsightIDR, targeting activity such as process execution, authentication events, network connections, and file modifications. It also includes Velociraptor VQL queries and artifact recommendations for live host interrogation, Sigma rules that can be shared across teams or converted into other SIEM formats, and YARA rules where relevant.
Every generated query is reviewed by an analyst before use. LLMs can accelerate drafting and reduce repetitive work, but analyst validation remains essential for accuracy, syntax, and operational fit.
Stage 4: Hunt plan assembly
The pipeline assembles a structured markdown hunt plan organized by ATT&CK tactic. Each report includes an executive summary, an IOC sweep section when indicators are present, and a behavioral hunting section containing generated queries in fenced code blocks with clear explanations of what each query is designed to detect. This gives analysts a consistent output they can inspect, edit, execute, and reuse.
Building a reusable detection query library
A key design decision was the introduction of a persistent query cache. Each technique’s generated queries are saved as standalone markdown files, creating a growing library of reusable detection content.
This cache reduces cost and execution time because techniques seen in previous reports can be loaded from the library rather than regenerated. It also creates a practical feedback loop: analysts can correct, tune, and improve cached queries over time, and those improvements persist across future hunt plans.
By tracking which reports and campaigns reference each technique, the team can build an organic view of recurring adversary behavior and identify which techniques appear across multiple actors or campaigns. Over time, this helps narrow the focus to behaviors most relevant to the environment, providing useful context.
Executing hunts and analyzing results
Once a hunt plan has been reviewed and validated, a separate process executes approved queries against InsightIDR. Results are then parsed and summarized into a briefing that highlights which queries returned results, why those results may matter, which findings may require immediate investigation, and how the activity relates to the threat actor’s known tradecraft.
Analysts can then ask follow-up questions conversationally, such as which findings should be prioritized, which hosts or users require deeper review, or how results should be interpreted based on risk.
Velociraptor queries are still executed manually because of the level of access involved. Given the potential impact of live host interrogation, the team made the deliberate decision to keep that execution under direct analyst control.
Practical use cases for automated threat hunting
The pipeline has already proven useful across several hunting scenarios: For advanced threat actor reporting, it can process DFIR reports and APT advisories to quickly determine whether known tradecraft appears in the environment. For insider threat hunting, it can be adapted to focus on data movement, anomalous access patterns, staging, and exfiltration behaviors. For security hardening, it can process reports about common persistence mechanisms and misconfigurations to validate whether the environment is exposed to known attack paths.
Across each use case, the value comes from shortening the path between intelligence and action.
Automating the repetitive work, not the expertise
By automating the repetitive work of reading reports, mapping techniques, and drafting queries, analysts can spend more time interpreting results, understanding context, and making decisions. The pipeline turns a daily flood of threat intelligence into structured, queryable, and continuously improving detection content. What previously required hours or days of manual effort can now be completed in minutes, while the underlying library compounds in value with every report processed.
Login
