MalwarePublished 12 May 2026

Free OnlyFans Lure Used to Spread Cross-Platform CRPx0 Malware

Source SecurityWeek

Description

CRPx0 is a complex, stealthy malware campaign that targets macOS and Windows systems, and appears to have Linux capabilities in development. The post Free OnlyFans Lure Used to Spread Cross-Platform CRPx0 Malware appeared first on SecurityWeek .

Impact

The campaign results in financial theft through cryptocurrency wallet hijacking, significant data exfiltration leading to potential privacy and intellectual property loss, and ransomware encryption causing data unavailability. The attackers leverage double extortion by threatening to release stolen data publicly. Victims face potential financial loss from ransom payments and data exposure. The malware’s persistence and update capabilities increase the difficulty of eradication. The campaign affects personal devices primarily, with no confirmed targeting of enterprise environments.

Defensive guidance

Users should avoid downloading files from untrusted sources, especially those promising unauthorized access to paid content. Endpoint protection solutions should be updated to detect and block CRPx0 malware components. Monitoring for unusual clipboard activity and network connections to known command-and-control servers may help detect infections. Given the malware’s persistence and update mechanisms, full system scans and potential reimaging may be necessary upon detection.

Summary

This campaign employs social engineering by offering free OnlyFans accounts to entice users into downloading a malicious zip file. The zip contains a shortcut that installs CRPx0 malware on Windows and macOS systems. The malware monitors clipboard activity to hijack cryptocurrency transactions, exfiltrates selected user data as directed by its command-and-control server, and subsequently encrypts files using AES encryption with a unique key. It excludes critical system directories to maintain system stability. The ransomware displays ransom instructions in English, Russian, and Chinese and operates a leak site to pressure victims. The malware is modular, persistent, and capable of self-updating, with Linux capabilities in development. The campaign has compromised at least 38 victims and stolen over 10,000 terabytes of data.

References

securityweek.com/free-onlyfans-lure-used-to-spread-cross-platform-crpx0-malware/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 12 May 2026, 13:51 UTC

References

Community reviews

Related threats