Threat reportMalwareTL-2026-3939
Infostealer Campaign Using Spoofed Software Installers and DLL Sideloading (CoreMessaging.dll)
Infostealer Campaign Using Spoofed Software Installers and (TL-2026-3939), also tracked as Eosinophil campaign, is a high-severity malware campaign, first published 2026-10-20. It has no confirmed attribution, affects Microsoft Windows (any version that sideloads DLLs from the, maps to 6 MITRE ATT&CK techniques (T1005, T1036.005, T1204.002), and is covered by 9 detection rules and 27 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-3939
- Threat ID
- TL-2026-3939
- Also known as
- Eosinophil campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- consumer, cryptocurrency, gaming, technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 27
How Infostealer Campaign Using Spoofed Software Installers and works
VirusTotal reported an infostealer campaign active January 11-15, 2026 that distributes ZIP archives impersonating Malwarebytes, Logitech G Hub and other software, using DLL sideloading of a malicious CoreMessaging.dll. The DLL launches a secondary-stage infostealer that targets browser credentials and cryptocurrency wallet browser extensions.
Between January 11 and 15, 2026, VirusTotal (Joseliyo Sanchez) observed a cluster of ZIP archives posing as legitimate software installers. The primary naming pattern is malwarebytes-windows-github-io-X.X.X.zip. Secondary coverage also lists impersonation of Logitech G Hub, OpenIV and Asus Armoury Crate. First detection was January 11 and the latest observed occurrence January 14.
Each archive bundles a legitimate, trusted executable, a malicious CoreMessaging.dll, and a text file (gitconfig.com.txt or Agreement_About.txt) containing a single GitHub URL string. When the victim runs the legitimate EXE, Windows loads the malicious CoreMessaging.dll from the same directory (DLL sideloading, T1574.001). The report does not name the legitimate executable that was abused.
The malicious DLLs share distinctive artifacts: the version-info string '© 2026 Eosinophil LLC' (described as a fictitious entity), the string 'Peastaking plenipotence ductileness chilopodous codicillary.', and two exported functions named 15Mmm95ml1RbfjH1VUyelYFCf and 2dlSKEtPzvo1mHDN4FYgv. VirusTotal groups the ZIPs under VT behash 4acaac53c8340a8c236c91e68244e6cb and the secondary-stage payloads under behash 5ddb604194329c1f182d7ba74f6f5946. The bundled text files serve as an infrastructure pivot: the VT execution_parents relation of the text file hash 09a8b930c8b79e7c313e5e741e1d59c39ae91bc1f10cdefa68b47bf77519be57 enumerates related ZIP archives.
The DLL drops a secondary-stage infostealer that steals browser-stored credentials and cryptocurrency wallet data. Sandbox analysis flags the secondary payloads as STEALER (BrowserStealerGeneric). VirusTotal's YARA coverage refers to cryptocurrency wallet browser extension IDs, and secondary reporting adds MFA tools delivered as browser extensions. VirusTotal published the YARA rule win_dll_sideload_eosinophil_infostealer_jan26 and a public collection. The report names no malware family, no C2 infrastructure, no exfiltration channel and no threat actor. Because the sources disclose no C2 IPs or domains, no BeaconBeagle correlation was possible. Severity is analyst-assigned.
MITRE ATT&CK techniques used in TL-2026-3939
Collection
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1574.001 DLL; T1684.001 Impersonation
Execution
Credential Access
T1555.003 Credentials from Web Browsers
stealth
Affected products and versions in Infostealer Campaign Using Spoofed Software Installers and
- Microsoft — Windows (any version that sideloads DLLs from the application directory)
Vulnerable versions: Not version-specific; user-execution and DLL search-order abuse - Malwarebytes (impersonated brand) — Malwarebytes for Windows (spoofed installer, not a product vulnerability)
- Logitech (impersonated brand) — Logitech G Hub (spoofed installer, not a product vulnerability)
Remediation for Infostealer Campaign Using Spoofed Software Installers and
Immediate actions
- Hunt for CoreMessaging.dll loaded from user-writable paths (Downloads, Temp, extracted-archive folders) rather than System32
- Block or alert on the published ZIP, DLL and payload SHA256 hashes in EDR and email/web gateways
- Reset credentials and rotate sessions for any user who ran a malwarebytes-windows-github-io-*.zip archive
- Move cryptocurrency wallet assets to new wallets on any potentially affected endpoint
Workarounds
- Deploy the VirusTotal YARA rule win_dll_sideload_eosinophil_infostealer_jan26 in retro-hunt and endpoint scanning
- Hunt on VT queries: exports:15Mmm95ml1RbfjH1VUyelYFCf exports:2dlSKEtPzvo1mHDN4FYgv
Longer-term hardening
- Download software only from vendor-official sites; verify installers by publisher signature
- Restrict execution from user-writable directories with application control (WDAC/AppLocker)
- Deploy EDR with image-load telemetry to detect DLL sideloading
- Use hardware-backed MFA and avoid storing credentials in browsers
Weaknesses (CWE) in Infostealer Campaign Using Spoofed Software Installers and
Timeline of Infostealer Campaign Using Spoofed Software Installers and
- First malicious ZIP archive in the campaign observed by VirusTotal; activity window begins.
- Latest observed occurrence of a ZIP archive in the campaign reported by VirusTotal.
- End of the January 11-15 observed activity window for the spoofed-installer campaign.
- VirusTotal releases YARA rule win_dll_sideload_eosinophil_infostealer_jan26 (matching the two distinctive DLL exports) and a public VT collection of campaign indicators.
- VirusTotal publishes 'New Infostealer Campaign Targets Users via Spoofed Software Installers' with hashes, behashes, exports and campaign analysis.
- Rankiteo logs the campaign as a Malwarebytes brand-impersonation incident targeting user login credentials.
- SecurityOnline and Cryptika publish secondary coverage naming Logitech G Hub, OpenIV and Asus Armoury Crate as impersonated software and noting the BrowserStealerGeneric sandbox verdict and MFA-tool targeting.
Sources cited for Infostealer Campaign Using Spoofed Software Installers and
- New Infostealer Campaign Targets Users via Spoofed Software Installers (VirusTotal Blog)
- VirusTotal public collection for the campaign
- Fake Malwarebytes Campaign Exploits DLL Sideloading to Drop Infostealers (SecurityOnline)
- Threat Actors Impersonate as MalwareBytes to Attack Users and Steal Logins (Cryptika)
- Malwarebytes: Threat Actors Impersonate Malwarebytes to Steal User Login Credentials (Rankiteo)
- VirusTotal Blog archive, January 2026
Detection coverage for TL-2026-3939
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3939 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.