News Summary

• In late April 2026, a client reached out to us for incident response support after discovering a miner running on users’ computers.
• We later discovered that the malware was being distributed via illegal movie and TV show streaming sites.
• After analyzing the infection vector and the logic of the DLL, we concluded that this activity is a continuation of a campaign involving pirated digital libraries.
• Given the previously described activity, it’s safe to assume that this campaign has been active since at least 2022.