Loading story…
Google filed a civil action in the U.S. District Court for the Southern District of New York against alleged CryptBot distributors, accusing named defendants and unidentified operators of running a malware distribution enterprise built around the 360installer pay-per-install network and OffShoric hosting. The company said the group spread CryptBot through cracked-software and fake download sites, including trojanized versions of Google Chrome and Google Earth Pro, and that a federal judge unsealed the case and granted a temporary restraining order to support disruption of current and future distribution domains. Google alleged roughly 670,000 infections over the prior year from the identified sites alone and said the operation harmed Chrome users by stealing credentials, browser cookies, credit card data, social media logins, cryptocurrency wallet information, screenshots, and Chrome extension data for later sale and abuse.
Security research cited across multiple reports shows CryptBot has been a fast-moving infostealer operation for years, repeatedly changing its packing, filenames, scripts, code paths, and command-and-control infrastructure to evade detection while relying heavily on fake cracks, serials, and software installers surfaced in search results. Analysts documented multi-stage delivery using archives, BAT scripts, AutoIt components, and in some campaigns public services such as Bitbucket, where one malicious repository was observed serving malware at volumes suggesting about 40,000 downloads per day before takedown. Recent samples used recurring .top infrastructure and improved browser-theft logic for newer Chrome versions, while also downloading follow-on payloads such as ClipBanker, underscoring that CryptBot functioned not only as a credential thief but as part of a broader malware distribution ecosystem.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
14 events from the most recent confirmed update back to the earliest known activity.
Google said a federal judge in the Southern District of New York unsealed the case and granted a temporary restraining order supporting technical disruption, including takedowns of current and future CryptBot distribution domains.
Google announced a civil action targeting major CryptBot distributors it said were based in Pakistan and spreading the infostealer through trojanized software packages such as fake Google Chrome and Google Earth Pro installers.
OpenAnalysis published technical research on CryptBot, including sample hashes, a YARA rule, Python code to decrypt embedded configuration, and recurring .top /gate.php C2 patterns.
Google alleged that 168,055 computers were infected through the operation from 1 December 2022 through 28 February 2023.
AhnLab ASEC reported a recently modified CryptBot variant that removed several older features but updated Chrome path handling and fixed logic that had prevented successful theft on Chrome 96 and later.
Google's complaint states that CryptBot resurged in early 2022 after having first been identified in 2019.
ASEC reported that the fake software-download ecosystem commonly used to spread CryptBot was also distributing other malware families including RedLine, Vidar, and Remcos, using NSIS droppers and AutoIt-based loaders. The analysis described process hollowing into legitimate Windows binaries and use of intermediary services such as Tumblr to obtain C2 information.
AhnLab ASEC published analysis showing CryptBot being spread through fake software-download pages aimed at users seeking cracks and serials, with frequently changing BAT scripts and .top-domain C2 infrastructure.
AhnLab ASEC reported that CryptBot was being distributed through fake software, crack, and serial-number download sites surfaced in search results. The report documented a newly observed MalPE-packed delivery format, process hollowing execution, and secondary malware downloads including ClipBanker, with observed cases involving Formbook and SmokeLoader.
Atlassian removed the Bitbucket repository on 3 February 2020, about 67 hours after it was reported. The repository had been serving malware at rates that implied more than 355,100 downloads during that interval.
A public Bitbucket repository under the user name Lewis Shields, later used to host CryptBot and other malware, had existed since 16 January 2020.
Google's later court filing states that the CryptBot infostealer was initially identified in 2019.
Google filed a complaint in the U.S. District Court for the Southern District of New York against Zubair Saeed, Raheel Arshad, Mohammad Rasheed Siddiqui, and unidentified operators, alleging they ran the 360installer and OffShoric infrastructure used to distribute CryptBot.
Researchers reported the malware-hosting Bitbucket repository to Atlassian on a Friday afternoon before its eventual removal.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
blog.google
Open sourceresearch.openanalysis.net
Open sourceasec.ahnlab.com
Open sourceasec.ahnlab.com
Open sourceasec.ahnlab.com
Open sourceasec.ahnlab.com
Open sourcegdatasoftware.com
Open sourceregmedia.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A refreshed **CryptBot** campaign has been distributing a Windows infostealer through websites posing as sources for cracked software, key generators, and free game or professional software downloads. The malware steals browser credentials, cookies, browsing history, cryptocurrency wallet data, credit card information, and files from infected systems, while operators use **SEO poisoning** and rapidly rotated lure sites and command-and-control infrastructure to drive victims to malicious downloads. Reporting indicates the malware was heavily associated with users seeking pirated software, and telemetry in one analyzed campaign suggested Russia was a primary target. Technical analysis of a newer CryptBot downloader shows a 32-bit statically linked sample using **libcurl `8.10.1`** and **OpenSSL `3.3.2`**, with evolving obfuscation that includes modified plaintext C2 URLs and control-flow tricks in the main routine. The downloader fetched an encrypted second-stage DLL over unencrypted HTTP from `.top` domains, then decrypted it with **AES-CBC** using a **PBKDF2-SHA1**-derived key built from the server-provided filename, the URL, and a static key suffix embedded in the sample. Researchers also noted the malware had been streamlined by removing some older anti-analysis and collection features while improving Chrome data theft so it could extract information across all Chrome versions rather than a limited version range.
Aug 15, 2026
Researchers reported multiple malware delivery campaigns using **malicious email**, **fake browser updates**, and likely **content injection** on compromised websites to install infostealers and remote access trojans. One campaign abused WordPress sites to present a fake **Google Chrome** update that delivered credential-stealing malware, while another used malicious **PEC** email lures tied to crypto-wallet themes to infect targets with remote access tooling and theft-focused payloads. Separate reporting also described spam operations distributing evasive malware through email, showing continued reliance on social engineering and web-based lures to gain initial access. The activity aligns with attacker use of **MITRE ATT&CK** techniques including `T1659` for content injection and `T1555` for stealing credentials from password stores. Once installed, these malware families commonly target saved passwords and account data from browsers, email clients, FTP/SFTP tools, Wi-Fi profiles, and Windows credential stores using utilities and methods associated with tools such as **LaZagne**, **Mimikatz**, **MailPassView**, and **Network Password Recovery**. The campaigns underscore a persistent threat pattern in which adversaries combine deceptive delivery methods with credential theft to expand access, move laterally, and compromise additional systems.
Aug 11, 2026
Multiple active **social-engineering-driven malware operations** are targeting end users through trusted distribution channels. One campaign, dubbed **GhostPoster**, distributed **17 malicious browser extensions** across *Chrome, Firefox, and Edge* with **840,000+ installs**, using legitimate-sounding names (e.g., “Google Translate in Right Click,” “Youtube Download,” “Ads Block Ultimate”) and evading store reviews for years. The extensions used **steganography** to hide code in PNGs, then extracted payloads to contact attacker infrastructure, enabling credential/data theft, tracking, affiliate-link hijacking, script injection, and HTTP header manipulation to weaken protections. Separately, threat actors are impersonating **Malwarebytes** via trojanized ZIP “installers” (e.g., `malwarebytes-windows-github-io-X.X.X.zip`) and using **DLL sideloading**—pairing a legitimate EXE with a malicious `CoreMessaging.dll`—to execute **infostealers**; reporting highlighted a campaign fingerprint via **behash** `4acaac53c8340a8c236c91e68244e6cb` and distinctive DLL strings used for infrastructure mapping. A different operation identified by CloudSEK involves **“RedLineCyber”** masquerading as an affiliate of “RedLine Solutions” to build credibility inside private **Discord** communities and deliver a Python-based **clipboard hijacker** (often `Pro.exe` / `peeek.exe`) aimed at **cryptocurrency wallet theft**, relying on long-term grooming of high-value targets rather than broad phishing.
Jun 29, 2026