This campaign employs social engineering by offering free OnlyFans accounts to entice users into downloading a malicious zip file. The zip contains a shortcut that installs CRPx0 malware on Windows and macOS systems. The malware monitors clipboard activity to hijack cryptocurrency transactions, exfiltrates selected user data as directed by its command-and-control server, and subsequently encrypts files using AES encryption with a unique key. It excludes critical system directories to maintain system stability. The ransomware displays ransom instructions in English, Russian, and Chinese and operates a leak site to pressure victims. The malware is modular, persistent, and capable of self-updating, with Linux capabilities in development. The campaign has compromised at least 38 victims and stolen over 10,000 terabytes of data.

The campaign results in financial theft through cryptocurrency wallet hijacking, significant data exfiltration leading to potential privacy and intellectual property loss, and ransomware encryption causing data unavailability. The attackers leverage double extortion by threatening to release stolen data publicly. Victims face potential financial loss from ransom payments and data exposure. The malware’s persistence and update capabilities increase the difficulty of eradication. The campaign affects personal devices primarily, with no confirmed targeting of enterprise environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid downloading files from untrusted sources, especially those promising unauthorized access to paid content. Endpoint protection solutions should be updated to detect and block CRPx0 malware components. Monitoring for unusual clipboard activity and network connections to known command-and-control servers may help detect infections. Given the malware’s persistence and update mechanisms, full system scans and potential reimaging may be necessary upon detection. No official fix or patch is currently documented; follow vendor advisories for updates.