GPU-Targeted Cryptojacking Campaign — SEO + AI Chatbot Poisoning Delivers ScreenConnect & SimpleRunPE Process Hollowing into .NET Utilities (Microsoft Defender Experts) — Threadlinqs Intelligence
As of 2026-05-30, GPU-Targeted Cryptojacking Campaign — SEO + AI Chatbot Poisoning Delivers ScreenConnect & SimpleRunPE Process Hollowing into .NET Utilities (Microsoft Defender Experts) is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-0597 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Microsoft Defender Experts disclosed an active cryptojacking campaign that surfaces trojanised system-utility downloads (CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec
OVERVIEW
Microsoft Defender Experts (MDE) published research on 2026-05-26 detailing a multi-stage cryptojacking operation that combines old-school SEO poisoning with a newer LLM-recommendation poisoning vector. Threat actors register typo-squat and look-alike domains that impersonate trusted system-utility vendors and rank them on search engines, while simultaneously seeding AI chatbots (browser-integrated assistants and standalone LLM tools) to recommend the same domains when users ask 'where can I download CrystalDiskInfo?' or similar utility-finding queries. The campaign deliberately profiles GPU enthusiasts — gamers, miners, overclockers, content creators — by impersonating exactly six hardware-monitoring and media utilities they are likely to install: CrystalDiskInfo, HWMonitor, Display Driver Uninstaller (DDU), FurMark, K-Lite Codec Pack, and PDFgear.
INITIAL ACCESS
When the victim runs the downloaded MSI/EXE installer, a legitimate signed binary from the impersonated vendor is dropped alongside a malicious autorun.dll in the same directory. The legitimate EXE has a DLL search-order hijack that resolves autorun.dll from the application directory before Windows system paths, satisfying the standard DLL sideloading prerequisite. The signed parent process inherits the malicious code execution, which keeps Authenticode and many EDR reputation engines quiet during the first stage.
DLL SIDELOAD AND SCREENCONNECT INSTALL
autorun.dll spawns msiexec.exe with /quiet /norestart arguments to install a ConnectWise ScreenConnect RMM client whose configuration package is named vcredist_x64.dll — a deliberate masquerade for Microsoft Visual C++ Redistributable. The ScreenConnect client beacons back to attacker-controlled relay infrastructure (instance IDs and access-codes vary by campaign wave) and provides persistent, GUI-quality remote access for the actor before the cryptominer is even staged. Because ScreenConnect is a legitimate signed RMM, EDR allow-lists in many enterprises pass the binary uninspected.
SIMPLE RUNPE PROCESS HOLLOWING
The second-stage payload is SimpleRunPE.exe, a fork of the public Watermwo/Simple-RunPE-Process-Hollowing proof-of-concept on GitHub. The attacker compiles the PoC with minor identifier changes and renames the binary RuntimeHost.exe to evade family-name signatures. SimpleRunPE implements the classic CreateProcess(SUSPENDED) → NtUnmapViewOfSection → VirtualAllocEx → WriteProcessMemory → SetThreadContext → ResumeThread sequence, swapping the image of a legitimate target process for the miner payload while the PE header reports the original Microsoft-signed identity. Target processes are .NET helper utilities shipped with the .NET Framework, all under %WINDIR%\Microsoft.NET\Framework64\: InstallUtil.exe, RegAsm.exe, RegSvcs.exe, MSBuild.exe, AppLaunch.exe, AddInProcess.exe, and aspnet_compiler.exe. These binaries are present on virtually every Windows host, are Microsoft-signed, and are commonly allow-listed.
MINING PAYLOAD AND GPU PROFILING
The hollowed payload is one of three GPU miners selected at runtime based on detected GPU vendor and model: gminer (NVIDIA-optimised, supports KAWPOW/Ethash variants), lolMiner (broad NVIDIA/AMD support, FLUX/ETC), and SRBMiner-MULTI (AMD-optimised, Monero/RandomX and dual-mining). The loader queries WMI (Win32_VideoController) to enumerate AdapterRAM, DriverVersion, and Name, then chooses the miner and algorithm yielding highest hash-rate for the silicon present. Mining is throttled when foreground process load is detected (GetForegroundWindow + idle-time heuristics) to evade user perception of system slowdown.
C2 INFRASTRUCTURE
Command-and-control uses certificate-pinned WebSocket over TLS to wss://minemine.gleeze.com:8443/ws. The leaf certificate's SHA-256 fingerprint is hard-coded into the loader and verified before mining configuration (pool URL, wallet, worker name) is accepted. The gleeze.com parent zone hosts dozens of look-alike subdomains used a
Weaknesses (CWE)
CWE-427, CWE-829, CWE-426
Target sectors: consumer, gaming, media-production, engineering, education, small-business
Target regions: Global
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1608, T1608, T1189, T1204, T1218, T1218, T1218, T1127, T1547