# GPU-Targeted Cryptojacking Campaign — SEO + AI Chatbot Poisoning Delivers ScreenConnect & SimpleRunPE Process Hollowing into .NET Utilities (Microsoft Defender Experts)

> Microsoft Defender Experts disclosed an active cryptojacking campaign that surfaces trojanised system-utility downloads (CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec Pack, PDFgear) through both traditional SEO poisoning and AI chatbot recommendations. After a signed EXE sideloads a malicious autorun.dll, the loader silently installs ScreenConnect via msiexec.exe for persistent remote access, then drops SimpleRunPE.exe (renamed RuntimeHost.exe) to process-hollow gminer/lolMiner/SRBMiner-MULTI mining code into Microsoft-signed .NET utilities. GPU enthusiasts are deliberately targeted to maximise mining yield; 150+ malicious domains have been tracked since March 2026.

- **Published:** 2026-05-26T00:00:00Z
- **Last reviewed:** 2026-05-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0597
- **ID:** TL-2026-0597
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

OVERVIEW

Microsoft Defender Experts (MDE) published research on 2026-05-26 detailing a multi-stage cryptojacking operation that combines old-school SEO poisoning with a newer LLM-recommendation poisoning vector. Threat actors register typo-squat and look-alike domains that impersonate trusted system-utility vendors and rank them on search engines, while simultaneously seeding AI chatbots (browser-integrated assistants and standalone LLM tools) to recommend the same domains when users ask 'where can I download CrystalDiskInfo?' or similar utility-finding queries. The campaign deliberately profiles GPU enthusiasts — gamers, miners, overclockers, content creators — by impersonating exactly six hardware-monitoring and media utilities they are likely to install: CrystalDiskInfo, HWMonitor, Display Driver Uninstaller (DDU), FurMark, K-Lite Codec Pack, and PDFgear.

INITIAL ACCESS

When the victim runs the downloaded MSI/EXE installer, a legitimate signed binary from the impersonated vendor is dropped alongside a malicious autorun.dll in the same directory. The legitimate EXE has a DLL search-order hijack that resolves autorun.dll from the application directory before Windows system paths, satisfying the standard DLL sideloading prerequisite. The signed parent process inherits the malicious code execution, which keeps Authenticode and many EDR reputation engines quiet during the first stage.

DLL SIDELOAD AND SCREENCONNECT INSTALL

autorun.dll spawns msiexec.exe with /quiet /norestart arguments to install a ConnectWise ScreenConnect RMM client whose configuration package is named vcredist_x64.dll — a deliberate masquerade for Microsoft Visual C++ Redistributable. The ScreenConnect client beacons back to attacker-controlled relay infrastructure (instance IDs and access-codes vary by campaign wave) and provides persistent, GUI-quality remote access for the actor before the cryptominer is even staged. Because ScreenConnect is a legitimate signed RMM, EDR allow-lists in many enterprises pass the binary uninspected.

SIMPLE RUNPE PROCESS HOLLOWING

The second-stage payload is SimpleRunPE.exe, a fork of the public Watermwo/Simple-RunPE-Process-Hollowing proof-of-concept on GitHub. The attacker compiles the PoC with minor identifier changes and renames the binary RuntimeHost.exe to evade family-name signatures. SimpleRunPE implements the classic CreateProcess(SUSPENDED) → NtUnmapViewOfSection → VirtualAllocEx → WriteProcessMemory → SetThreadContext → ResumeThread sequence, swapping the image of a legitimate target process for the miner payload while the PE header reports the original Microsoft-signed identity. Target processes are .NET helper utilities shipped with the .NET Framework, all under %WINDIR%\Microsoft.NET\Framework64\: InstallUtil.exe, RegAsm.exe, RegSvcs.exe, MSBuild.exe, AppLaunch.exe, AddInProcess.exe, and aspnet_compiler.exe. These binaries are present on virtually every Windows host, are Microsoft-signed, and are commonly allow-listed.

MINING PAYLOAD AND GPU PROFILING

The hollowed payload is one of three GPU miners selected at runtime based on detected GPU vendor and model: gminer (NVIDIA-optimised, supports KAWPOW/Ethash variants), lolMiner (broad NVIDIA/AMD support, FLUX/ETC), and SRBMiner-MULTI (AMD-optimised, Monero/RandomX and dual-mining). The loader queries WMI (Win32_VideoController) to enumerate AdapterRAM, DriverVersion, and Name, then chooses the miner and algorithm yielding highest hash-rate for the silicon present. Mining is throttled when foreground process load is detected (GetForegroundWindow + idle-time heuristics) to evade user perception of system slowdown.

C2 INFRASTRUCTURE

Command-and-control uses certificate-pinned WebSocket over TLS to wss://minemine.gleeze.com:8443/ws. The leaf certificate's SHA-256 fingerprint is hard-coded into the loader and verified before mining configuration (pool URL, wallet, worker name) is accepted. The gleeze.com parent zone hosts dozens of look-alike subdomains used as ScreenConnect relays and miner-config endpoints. Microsoft Defender Experts has tracked 150+ campaign-controlled domains since March 2026, many registered through privacy-protected registrars with Cloudflare or Stark Industries hosting in front of bullet-proof origin servers.

PERSISTENCE

Six concurrent persistence mechanisms are established: (1) HKCU\Software\Microsoft\Windows\CurrentVersion\Run autorun pointing at the loader, (2) a Scheduled Task named 'Microsoft\Windows\WindowsUpdate\Update Orchestrator' running every 60 minutes, (3) a Windows Service ('NetMicrosoft' or 'WinHostUpdate') with auto-start, (4) the ScreenConnect agent itself (which is its own persistence channel), (5) WMI Event Subscription using __EventFilter / CommandLineEventConsumer triggering on user logon, and (6) an auto-repair watchdog that re-creates any of the above if removed. Removal of fewer than all six mechanisms allows the watchdog to restore full persistence within minutes.

IMPACT AND OUTLOOK

While the immediate monetisation is GPU cryptomining, the persistent ScreenConnect RMM foothold provides the actor a hands-on-keyboard channel that can later be repurposed for credential theft, lateral movement, data theft, or ransomware staging. Treat any host with confirmed ScreenConnect-via-vcredist_x64.dll indicator as fully compromised; cryptomining cleanup alone is insufficient.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1189 Drive-by Compromise
- T1204 User Execution
- T1218 System Binary Proxy Execution
- T1127 Trusted Developer Utilities Proxy Execution
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1543 Create or Modify System Process
- T1546 Event Triggered Execution
- T1574 Hijack Execution Flow
- T1055 Process Injection
- T1036 Masquerading
- T1553 Subvert Trust Controls
- T1070 Indicator Removal
- T1082 System Information Discovery
- T1012 Query Registry
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1219 Remote Access Tools
- T1105 Ingress Tool Transfer
- T1496 Resource Hijacking

## Sources

- [Microsoft Security Blog — From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities](https://www.microsoft.com/en-us/security/blog/2026/05/26/poisoned-search-results-gpu-mining-cryptojacking-campaign-abusing-screenconnect-microsoft-net-utilities/)
- [MITRE ATT&CK — T1574.002 DLL Side-Loading](https://attack.mitre.org/techniques/T1574/002/)
- [MITRE ATT&CK — T1055.012 Process Hollowing](https://attack.mitre.org/techniques/T1055/012/)
- [MITRE ATT&CK — T1219 Remote Access Software](https://attack.mitre.org/techniques/T1219/)
- [MITRE ATT&CK — T1496 Resource Hijacking](https://attack.mitre.org/techniques/T1496/)
- [Watermwo/Simple-RunPE-Process-Hollowing (public PoC the loader is forked from)](https://github.com/Watermwo/Simple-RunPE-Process-Hollowing)
- [ConnectWise ScreenConnect — RMM product overview (abused, not vulnerable)](https://www.connectwise.com/software/screenconnect)
- [gminer GPU miner (NVIDIA-optimised, abused payload)](https://github.com/develsoftware/GMinerRelease)
- [lolMiner (multi-GPU miner, abused payload)](https://github.com/Lolliedieb/lolMiner-releases)
- [SRBMiner-MULTI (AMD-optimised miner, abused payload)](https://github.com/doktor83/SRBMiner-Multi)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0597