Pirates in the crosshairs: how one cybercrime gang has been infecting book, movie, and TV show fans for years
In April 2026, a cybercrime gang has been using fake video player plugin updates to distribute a cryptocurrency miner, a tactic that has been ongoing since at least 2022. The gang leverages pirated digital libraries and streaming sites, targeting users with a ZIP archive containing a malicious DLL that utilizes a stack overflow vulnerability to execute shellcode. The campaign has evolved over time, updating both the malware and distribution methods, and has impacted a large user base across multiple platforms.
A client reported a cryptocurrency miner running on a user's computer, traced back to a distribution method involving fake updates for video player plugins. The attack chain began with users encountering a message prompting them to update a video player plugin, leading them to download a ZIP archive containing a legitimate executable (HLS Installer.874.exe) and a malicious DLL. The DLL employed a side-loading mechanism to inject itself into a legitimate process, executing code within that process's context and deploying the miner. Analysis revealed the campaign is a continuation of a previously identified activity involving pirated digital libraries and streaming sites, utilizing domains like file[.]ipfs[.]us[.]69[.]mu and, more recently, urush1bar4[.]online. The distribution scale is significant, with sites hosting the malware receiving tens of millions of visits monthly, impacting user bases ranging from 11,000 to 27.4 million. The threat actor has consistently updated the malware and distribution methods over the past several years, demonstrating adaptability and persistence. The core technique relies on exploiting a stack overflow vulnerability within the DLL to construct a ROP chain and decrypt the next stage of the attack.