GPU-Targeted Cryptojacking Campaign — SEO + AI Chatbot Poisoning Delivers ScreenConnect & SimpleRunPE Process Hollowing into .NET Utilities (Microsoft Defender Experts)
GPU-Targeted Cryptojacking Campaign (TL-2026-0597), also tracked as Poisoned-Search Cryptojacker, is a high-severity malware campaign, first published 2026-05-26. It has no confirmed attribution, affects Microsoft Windows, maps to 22 MITRE ATT&CK techniques (T1012, T1036, T1053), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-0597
- Threat ID
- TL-2026-0597
- Also known as
- Poisoned-Search Cryptojacker, Gleeze Cryptominer, RuntimeHost Hollower
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-05-26
- Last reviewed
- 2026-05-26
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- consumer, gaming, media-production, engineering, education, small-business
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in GPU-Targeted Cryptojacking Campaign
Malware and tooling: GPU-Cryptojacker (MDE-tracked cluster, no public family name yet), ConnectWise ScreenConnect (RMM abused as long-term C2 channel), ConnectWise ScreenConnect (RMM, abused — not vulnerable), SRBMiner-MULTI, SimpleRunPE (Watermwo fork), gminer, lolMiner
Microsoft Defender Experts disclosed an active cryptojacking campaign that surfaces trojanised system-utility downloads (CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec Pack, PDFgear) through both traditional SEO poisoning and AI chatbot recommendations. After a signed EXE sideloads a malicious autorun.dll, the loader silently installs ScreenConnect via msiexec.exe for persistent remote access, then drops SimpleRunPE.exe (renamed RuntimeHost.exe) to process-hollow gminer/lolMiner/SRBMiner-MULTI mining code into Microsoft-signed .NET utilities. GPU enthusiasts are deliberately targeted to maximise mining yield; 150+ malicious domains have been tracked since March 2026.
How GPU-Targeted Cryptojacking Campaign works
OVERVIEW
Microsoft Defender Experts (MDE) published research on 2026-05-26 detailing a multi-stage cryptojacking operation that combines old-school SEO poisoning with a newer LLM-recommendation poisoning vector. Threat actors register typo-squat and look-alike domains that impersonate trusted system-utility vendors and rank them on search engines, while simultaneously seeding AI chatbots (browser-integrated assistants and standalone LLM tools) to recommend the same domains when users ask 'where can I download CrystalDiskInfo?' or similar utility-finding queries. The campaign deliberately profiles GPU enthusiasts — gamers, miners, overclockers, content creators — by impersonating exactly six hardware-monitoring and media utilities they are likely to install: CrystalDiskInfo, HWMonitor, Display Driver Uninstaller (DDU), FurMark, K-Lite Codec Pack, and PDFgear.
INITIAL ACCESS
When the victim runs the downloaded MSI/EXE installer, a legitimate signed binary from the impersonated vendor is dropped alongside a malicious autorun.dll in the same directory. The legitimate EXE has a DLL search-order hijack that resolves autorun.dll from the application directory before Windows system paths, satisfying the standard DLL sideloading prerequisite. The signed parent process inherits the malicious code execution, which keeps Authenticode and many EDR reputation engines quiet during the first stage.
DLL SIDELOAD AND SCREENCONNECT INSTALL
autorun.dll spawns msiexec.exe with /quiet /norestart arguments to install a ConnectWise ScreenConnect RMM client whose configuration package is named vcredist_x64.dll — a deliberate masquerade for Microsoft Visual C++ Redistributable. The ScreenConnect client beacons back to attacker-controlled relay infrastructure (instance IDs and access-codes vary by campaign wave) and provides persistent, GUI-quality remote access for the actor before the cryptominer is even staged. Because ScreenConnect is a legitimate signed RMM, EDR allow-lists in many enterprises pass the binary uninspected.
SIMPLE RUNPE PROCESS HOLLOWING
The second-stage payload is SimpleRunPE.exe, a fork of the public Watermwo/Simple-RunPE-Process-Hollowing proof-of-concept on GitHub. The attacker compiles the PoC with minor identifier changes and renames the binary RuntimeHost.exe to evade family-name signatures. SimpleRunPE implements the classic CreateProcess(SUSPENDED) → NtUnmapViewOfSection → VirtualAllocEx → WriteProcessMemory → SetThreadContext → ResumeThread sequence, swapping the image of a legitimate target process for the miner payload while the PE header reports the original Microsoft-signed identity. Target processes are .NET helper utilities shipped with the .NET Framework, all under %WINDIR%\Microsoft.NET\Framework64\: InstallUtil.exe, RegAsm.exe, RegSvcs.exe, MSBuild.exe, AppLaunch.exe, AddInProcess.exe, and aspnet_compiler.exe. These binaries are present on virtually every Windows host, are Microsoft-signed, and are commonly allow-listed.
MINING PAYLOAD AND GPU PROFILING
The hollowed payload is one of three GPU miners selected at runtime based on detected GPU vendor and model: gminer (NVIDIA-optimised, supports KAWPOW/Ethash variants), lolMiner (broad NVIDIA/AMD support, FLUX/ETC), and SRBMiner-MULTI (AMD-optimised, Monero/RandomX and dual-mining). The loader queries WMI (Win32_VideoController) to enumerate AdapterRAM, DriverVersion, and Name, then chooses the miner and algorithm yielding highest hash-rate for the silicon present. Mining is throttled when foreground process load is detected (GetForegroundWindow + idle-time heuristics) to evade user perception of system slowdown.
C2 INFRASTRUCTURE
Command-and-control uses certificate-pinned WebSocket over TLS to wss://minemine.gleeze.com:8443/ws. The leaf certificate's SHA-256 fingerprint is hard-coded into the loader and verified before mining configuration (pool URL, wallet, worker name) is accepted. The gleeze.com parent zone hosts dozens of look-alike subdomains used as ScreenConnect relays and miner-config endpoints. Microsoft Defender Experts has tracked 150+ campaign-controlled domains since March 2026, many registered through privacy-protected registrars with Cloudflare or Stark Industries hosting in front of bullet-proof origin servers.
PERSISTENCE
Six concurrent persistence mechanisms are established: (1) HKCU\Software\Microsoft\Windows\CurrentVersion\Run autorun pointing at the loader, (2) a Scheduled Task named 'Microsoft\Windows\WindowsUpdate\Update Orchestrator' running every 60 minutes, (3) a Windows Service ('NetMicrosoft' or 'WinHostUpdate') with auto-start, (4) the ScreenConnect agent itself (which is its own persistence channel), (5) WMI Event Subscription using __EventFilter / CommandLineEventConsumer triggering on user logon, and (6) an auto-repair watchdog that re-creates any of the above if removed. Removal of fewer than all six mechanisms allows the watchdog to restore full persistence within minutes.
IMPACT AND OUTLOOK
While the immediate monetisation is GPU cryptomining, the persistent ScreenConnect RMM foothold provides the actor a hands-on-keyboard channel that can later be repurposed for credential theft, lateral movement, data theft, or ransomware staging. Treat any host with confirmed ScreenConnect-via-vcredist_x64.dll indicator as fully compromised; cryptomining cleanup alone is insufficient.
MITRE ATT&CK techniques used in TL-2026-0597
Discovery
T1012 Query Registry; T1082 System Information Discovery
Defense Evasion
T1036 Masquerading; T1055 Process Injection; T1070 Indicator Removal
Persistence
T1053 Scheduled Task/Job; T1543 Create or Modify System Process; T1546 Event Triggered Execution; T1547 Boot or Logon Autostart Execution
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1573 Encrypted Channel
Execution
T1127 Trusted Developer Utilities Proxy Execution
Initial Access
execution
stealth
T1218 System Binary Proxy Execution; T1574 Hijack Execution Flow
Impact
defense-impairment
Resource Development
Affected products and versions in GPU-Targeted Cryptojacking Campaign
- Microsoft — Windows
Vulnerable versions: 10; 11; Server 2019; Server 2022; Server 2025 - Microsoft — .NET Framework helper utilities (process-hollowing targets)
Vulnerable versions: InstallUtil.exe; RegAsm.exe; RegSvcs.exe; MSBuild.exe; AppLaunch.exe; AddInProcess.exe; aspnet_compiler.exe - ConnectWise — ScreenConnect (abused as RMM, not a vulnerability in the product)
Vulnerable versions: all
Remediation for GPU-Targeted Cryptojacking Campaign
Immediate actions
- Block all known campaign domains and the C2 host minemine.gleeze.com at proxy/DNS/firewall layers
- Hunt for ScreenConnect installations whose package file name is vcredist_x64.dll — treat as indicator of compromise
- Hunt for autorun.dll loaded by legitimate signed system-utility executables (CrystalDiskInfo, HWMonitor, DDU, FurMark, K-Lite, PDFgear) in non-default install paths
- Hunt for child processes of msiexec.exe spawned without an MSI install context (no /i package.msi flag pattern)
- Hunt for RuntimeHost.exe in user-writable paths and for SimpleRunPE-derived process hollowing into Microsoft .NET utilities (InstallUtil.exe, RegAsm.exe, RegSvcs.exe, MSBuild.exe, AppLaunch.exe, AddInProcess.exe, aspnet_compiler.exe)
- Treat any host with confirmed ScreenConnect-via-vcredist_x64.dll IOC as fully compromised — full reimage, not cleanup
Workarounds
- Block outbound WebSocket TLS (wss://) connections to non-corporate destinations at egress proxies where business policy permits
- Restrict execution of .NET Framework helper utilities (InstallUtil.exe, RegAsm.exe, RegSvcs.exe, MSBuild.exe, AppLaunch.exe, AddInProcess.exe, aspnet_compiler.exe) outside developer machines via AppLocker rules
Longer-term hardening
- Deploy application allow-listing (WDAC or AppLocker) covering Microsoft.NET\Framework64 .NET helper utilities to alert on anomalous network egress or GPU usage from those binaries
- Restrict installation of unauthorized RMM agents (ScreenConnect, AnyDesk, TeamViewer, etc.) at endpoint policy and EDR levels — maintain an approved-RMM allow-list
- Enable WMI persistence telemetry collection and alert on new __EventFilter / CommandLineEventConsumer bindings
- Educate GPU-enthusiast user populations (gaming, content-creation, engineering) on the AI chatbot recommendation poisoning risk; sanction vendor-direct download channels only
- Monitor GPU utilisation telemetry on workstations and flag sustained 70%+ utilisation outside of known workloads
Weaknesses (CWE) in GPU-Targeted Cryptojacking Campaign
CWE-427, CWE-829, CWE-426
Timeline of GPU-Targeted Cryptojacking Campaign
- Watermwo publishes Simple-RunPE-Process-Hollowing PoC on GitHub — later forked by the actor as the basis of RuntimeHost.exe.
- First wave of campaign-controlled domains impersonating GPU/system utilities begins to surface in search-engine results and AI chatbot recommendations (per Microsoft Defender Experts telemetry).
- MDE observes the campaign chaining DLL sideloading into silent ScreenConnect install via msiexec.exe (vcredist_x64.dll masquerade).
- MDE observes SimpleRunPE-derived RuntimeHost.exe process-hollowing GPU miner code into Microsoft-signed .NET utilities (InstallUtil.exe, RegAsm.exe, MSBuild.exe and four others).
- MDE confirms that some victims arrived via AI chatbot download recommendations rather than search-engine clicks — first documented LLM-recommendation-poisoning vector at this scale.
- Microsoft Defender Experts tally exceeds 150 distinct malicious domains tied to the same actor cluster since March.
- Threadlinqs Intelligence publishes TL-2026-0597 with full MITRE mapping, IOCs, and detection coverage.
- Microsoft Security Blog publishes the full Defender Experts write-up disclosing TTPs, IOCs, and victimology.
- As of 2026-05-29, this Microsoft Defender Experts cryptojacking campaign is still active and ongoing since March 2026, with 150+ rotating gleeze.com lure domains, fresh AI-chatbot/SEO poisoning, and ScreenConnect+.NET-LOLBin process hollowing. No takedown, sinkhole, or arrest reported; disclosure was only 3 days prior (2026-05-26) and the actor remains unattributed and operational.
Sources cited for GPU-Targeted Cryptojacking Campaign
- Microsoft Security Blog — From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities
- MITRE ATT&CK — T1574.002 DLL Side-Loading
- MITRE ATT&CK — T1055.012 Process Hollowing
- MITRE ATT&CK — T1219 Remote Access Software
- MITRE ATT&CK — T1496 Resource Hijacking
- Watermwo/Simple-RunPE-Process-Hollowing (public PoC the loader is forked from)
- ConnectWise ScreenConnect — RMM product overview (abused, not vulnerable)
- gminer GPU miner (NVIDIA-optimised, abused payload)
- lolMiner (multi-GPU miner, abused payload)
- SRBMiner-MULTI (AMD-optimised miner, abused payload)
Threats related to GPU-Targeted Cryptojacking Campaign
- AsyncRAT Campaign Uses DLL Sideloading and ScreenConnect for Stealthy Remote Access (SEO-Poisoned Fake Installer Sites)
- Node.js Living-off-the-Land: Multiple Threat Actors Abuse Signed node.exe as a Script Interpreter, Feeding Ransomware Access Brokers
- ScreenConnect Masked as Freeware: Large-Scale AsyncRAT Distribution Campaign via SEO-Poisoned Fake Software Sites
- Tiflux RMM Triple-Threat Campaign — Service-Agreement Malspam Chains UltraVNC + Splashtop + ScreenConnect with BYOVD HwRwDrv.sys for Privilege Escalation
- ClickFix / KongTuke Clipboard-Hijacking Social-Engineering Technique (MITRE T1204.004) — Fake-CAPTCHA Lures Delivering Infostealers, RATs, and Ransomware
- CPUID Supply Chain Attack Delivers STX RAT via Trojanized CPU-Z, HWMonitor, and PerfMonitor Downloads
Detection coverage for TL-2026-0597
As of 2026-05-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0597 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.