‘Vibe-Coded’ Malware Campaign Uses Fake Tools, CDNs and File Hosts to Infect Users
In January 2026, a significant malware campaign was identified. It involved over 443 malicious ZIP files disguised as software tools such as AI image generators, voice-changing tools, game hacks, Roblox script executors, VPN software, graphics card…
In January 2026, a significant malware campaign was identified. It involved over 443 malicious ZIP files disguised as software tools such as AI image generators, voice-changing tools, game hacks, Roblox script executors, VPN software, graphics card drivers, ransomware decryptors, and infostealer tools. These files were distributed across various platforms, including Discord, SourceForge, FOSSHub, MediaFire, and mydofiles.com.
The campaign utilized a file called WinUpdateHelper.dll, which was found in 48 unique variants. These variants fell into 17 distinct kill chains, each operated via separate command-and-control infrastructures. The shared use of cryptocurrency wallet credentials allowed for tracking of financial transactions.
McAfee analysts traced the origins of this threat back to December 2024, noting the incorporation of AI-generated scripting elements. The campaign primarily targeted users in the United States, followed by the United Kingdom, India, Brazil, France, Canada, and Australia.
The operation involved seven Bitcoin wallets, which collectively held approximately USD 4,536, with total received funds amounting to nearly USD 11,498. However, given the focus on mining privacy-oriented cryptocurrencies like Monero and Zephyr, the actual financial impact is likely higher.
These files were distributed across various platforms, including Discord, SourceForge, FOSSHub, MediaFire, and mydofiles.com.
When a user executes a trojanized ZIP archive, the WinUpdateHelper.dll file loads silently alongside a legitimate executable. The DLL redirects the user's browser to a page prompting the download of DependencyCore.zip, which installs unrelated software to distract the user.
Meanwhile, WinUpdateHelper.dll connects to a command-and-control server. The C2 domain refreshes every 58 days, complicating efforts to block it proactively. The malware establishes persistence by registering a Windows service named "Microsoft Console Host" that executes a PowerShell script in-memory, evading file-based detection.
The PowerShell script executes several actions, including removing older persistence entries, adding exclusions to Windows Defender, and deploying two coin miners—one for CPU-based Zephyr mining and another for GPU-based Ravencoin mining. In some cases, the final payload is either SalatStealer or a Mesh Agent remote access tool.
Users are advised to avoid downloading software from unofficial sources, regularly inspect active Windows services, and treat unsolicited dependency prompts with caution.
For further insights, visit the McAfee blog .
Based on reporting by Cyber Security News.