GPU mining malware spreads via SEO poisoning, AI chatbots
Recorded: May 27, 2026, 10 p.m.
| Original | Summarized |
GPU mining malware spreads via SEO poisoning, AI chatbots News Featured Glassworm botnet disrupted after resilient C2 infrastructure takedown CISA gives feds 4 days to patch actively exploited cPanel plugin flaw Windows 11 KB5089573 update released with performance improvements Charter confirms data breach after ShinyHunters extortion threat GPU mining malware spreads via SEO poisoning, AI chatbots This CompTIA IT learning path is only $40 through 6/14 Can you enforce strong Active Directory password rules without frustrating users? Glassworm botnet disrupted after resilient C2 infrastructure takedown Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityGPU mining malware spreads via SEO poisoning, AI chatbots GPU mining malware spreads via SEO poisoning, AI chatbots By Ionut Ilascu May 27, 2026 Threat actors are targeting systems with high-performance computers in an ongoing cryptojacking campaign spread through a coordinated SEO poisoning operation that also manipulated AI chatbot recommendations. Claim that ChatGPT directed to malicious URL for downloading CrystalDiskMarksource: Microsoft Malware establishing six persistence mechanismsource: Microsoft The Validation Gap: Automated Pentesting Answers One Question. You Need Six. Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.This guide covers the 6 surfaces you actually need to validate. Related Articles: CryptoMiner Ionut Ilascu Previous Article Post a Comment Community Rules You need to login in order to post a comment You may also like: Upcoming Webinar Popular Stories FBI warns of Kali365 phishing service targeting Microsoft 365 accounts Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign Anthropic’s restricted Claude Mythos model may be coming to Claude Code Sponsor Posts AI is a data-breach time bomb: Read the new report Protect Your Business from Ecommerce Fraud 33% Rise in Healthcare Credential Theft in 2025: What you need to know Overdue a password health-check? Audit your Active Directory for free Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
Threat actors are leveraging a coordinated operation involving SEO poisoning and artificial intelligence chatbots to propagate GPU mining malware targeting systems equipped with high-performance computing capabilities. The initial compromise occurs when users search for or interact with AI assistants requesting utility software downloads, and malicious links, boosted by SEO poisoning, direct users to attacker-controlled domains. These malicious download pages typically host legitimate utility software, such as CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, and others, while embedding a malicious Dynamic Link Library (DLL). Upon execution of the benign binary, this malicious DLL leverages msiexec.exe to install vcredist_x64.dll, a package installer for the ScreenConnect remote access tool, thereby establishing an initial foothold on the compromised system. Following the initial access, the threat actor deploys a secondary binary named SimpleRunPE.exe, which operates to achieve persistence across multiple Windows autostart locations by copying itself under the name RuntimeHost.exe. Researchers found that SimpleRunPE.exe exhibits characteristics of a process hollowing technique, utilizing a fork of a public repository for demonstration purposes. The malware attempts to achieve stealth by performing process hollowing into legitimate Microsoft-signed .NET binaries, including InstallUtil.exe, RegAsm.exe, RegSvcs.exe, MSBuild.exe, AppLaunch.exe, AddInProcess.exe, and aspnet_compiler.exe. Furthermore, the malicious binary invokes PowerShell to modify the exclusion list within Microsoft Defender, ensuring operational stealth. The malware employs anti-analysis measures by checking the system environment for virtual machines and a specific set of forty process names corresponding to common analysis tools, terminating its execution if such environments are detected. After successfully executing the process hollowing stage, the malware downloads and executes one of three mining modules designed to exploit the system's graphics processing units (GPUs): gminer, lolMiner, or SRBMiner-MULTI. The campaign’s monetization strategy is noted for being engineered to maximize the GPU mining yield per compromised device, rather than simply maximizing the volume of mined cryptocurrency. This entire mechanism demonstrates a sophisticated approach to exploiting user behavior and system vulnerabilities for stealthy, high-yield cryptojacking. |