Threats Tagged 'runtimehost'

An active cryptojacking campaign abuses poisoned search results to distribute malware targeting users with high-performance GPUs. Attackers impersonate trusted utilities, delivering ZIP archives containing legitimate executables bundled with malicious DLLs that establish persistence via ScreenConnect remote access tools. The campaign uses advanced techniques such as DLL sideloading, process hollowing into Microsoft-signed . NET binaries, and defense evasion. Beyond mining cryptocurrency, the malware enables persistent remote access potentially facilitating data theft, lateral movement, or ransomware deployment. The threat specifically targets PC enthusiasts likely to own discrete GPUs suitable for mining.