Ad copy

Behind a fake “video player update” was a years-long malware campaign. Kaspersky researchers uncovered an operation distributing remote access trojans and crypto miners through piracy-related streaming and download platforms. The campaign has likely been active since at least 2022 and relies on advanced techniques including DLL side-loading, process hollowing, DNS tunneling, and reflective loading. In April 2026 alone, websites associated with the campaign accumulated around 40 million visits. Full technical analysis on Securelist: https://kas.pr/zm69