A highly sophisticated cybercrime campaign has come to light, according to new research from Check Point Research, revealing that an unknown threat actor is leveraging legitimate online news platforms and popular internet services to promote malware (for crypto theft). The perpetrators appear to be applying digital marketing techniques typically used by large companies, creating an illusion of credibility around dangerous tools.
The new malware distribution model
According to the researchers, attackers are using paid or promoted posts on legitimate news sitesin an attempt to create buzz and interest around their software. This strategy is a significant evolution in social engineering methods, as cybercriminals are no longer limited to traditional phishing campaigns or deceptive emails.
See also: OpenClaw integrates VirusTotal scanning to detect malicious ClawHub skills
Instead, they exploit the trust users place in well-known media outlets and recognizable online platforms, presenting malicious tools as popular and trusted applications.
An entire ecosystem of deception
The investigation revealed that the threat actor has created a complete network to support its campaign. At its core is a dedicated phishing page hosted on WordPress that acts as a central distribution hub.
The perpetrators also maintain projects on GitHub and SourceForge, which are promoted through fake accounts. They also utilize a YouTube, as well as coordinated activity on VirusTotal , aiming to misclassify malicious files as safe.
Check Point points out that this is essentially a “fake reputation economy,” where every point a prospective user can check before downloading is carefully designed to project an image of trustworthiness.
The real goals of the campaign
Behind the campaign is a crypto clipboard hijacker. The malware is hidden within tools that promise quick profits, such as bots for the Solana ecosystem and the Pump.fun platform, as well as prediction apps for crash-style games.
The choice of these applications is not accidental. Digital asset owners and online gamers looking for automated solutions and easy profits are particularly attractive targets for cybercriminals. These users are often more willing to install software from unknown sources, as long as they believe they will gain a competitive advantage.
See also: VirusTotal: Apologizes for leaking data of 5,600 customers
Artificial popularity on GitHub and SourceForge
The campaign is also expanding to popular software development platforms. According to Check Point, the threat actor operates at least six different GitHub accounts, which are used to promote and distribute the malware.
In one of the cases, a GitHub repository displays 146 stars and 62 forks, which gives the impression of an active and reliable open source project.
A similar picture is seen on SourceForge, where the number of downloads exceeded 44,000. However, more than 37,000 users are said to be from Android, despite the fact that the alleged software is only available for Windows and macOS. Researchers consider it highly likely that these numbers have been artificially inflated by a large network of Android devices.
The use of YouTube and press releases as weapons of disinformation
The use of YouTube is also of particular interest. The relevant channel has more than 91,000 subscribers and hosts tutorial-style videos with narrators created through artificial intelligence. At the same time, positive comments and enthusiastic reviews appear, further reinforcing the image of credibility.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: Clipper malware attacks threaten crypto—what you can do
Even more worrying is the use of press release, through which the perpetrators managed to promote the alleged capabilities of their tools to cooperating news networks.
This case demonstrates that modern cybercrime is increasingly turning into an organized digital marketing. The manipulation of reputation and user trust is emerging as a weapon as powerful as the attack techniques themselves, creating new challenges for internet security.
