# Infostealer Campaign Using Spoofed Software Installers and DLL Sideloading (CoreMessaging.dll)

> VirusTotal reported an infostealer campaign active January 11-15, 2026 that distributes ZIP archives impersonating Malwarebytes, Logitech G Hub and other software, using DLL sideloading of a malicious CoreMessaging.dll. The DLL launches a secondary-stage infostealer that targets browser credentials and cryptocurrency wallet browser extensions.

- **Published:** 2026-10-20T07:21:37Z
- **Last reviewed:** 2026-10-20T07:21:37Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3939
- **ID:** TL-2026-3939
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Between January 11 and 15, 2026, VirusTotal (Joseliyo Sanchez) observed a cluster of ZIP archives posing as legitimate software installers. The primary naming pattern is malwarebytes-windows-github-io-X.X.X.zip. Secondary coverage also lists impersonation of Logitech G Hub, OpenIV and Asus Armoury Crate. First detection was January 11 and the latest observed occurrence January 14.

Each archive bundles a legitimate, trusted executable, a malicious CoreMessaging.dll, and a text file (gitconfig.com.txt or Agreement_About.txt) containing a single GitHub URL string. When the victim runs the legitimate EXE, Windows loads the malicious CoreMessaging.dll from the same directory (DLL sideloading, T1574.001). The report does not name the legitimate executable that was abused.

The malicious DLLs share distinctive artifacts: the version-info string '© 2026 Eosinophil LLC' (described as a fictitious entity), the string 'Peastaking plenipotence ductileness chilopodous codicillary.', and two exported functions named 15Mmm95ml1RbfjH1VUyelYFCf and 2dlSKEtPzvo1mHDN4FYgv. VirusTotal groups the ZIPs under VT behash 4acaac53c8340a8c236c91e68244e6cb and the secondary-stage payloads under behash 5ddb604194329c1f182d7ba74f6f5946. The bundled text files serve as an infrastructure pivot: the VT execution_parents relation of the text file hash 09a8b930c8b79e7c313e5e741e1d59c39ae91bc1f10cdefa68b47bf77519be57 enumerates related ZIP archives.

The DLL drops a secondary-stage infostealer that steals browser-stored credentials and cryptocurrency wallet data. Sandbox analysis flags the secondary payloads as STEALER (BrowserStealerGeneric). VirusTotal's YARA coverage refers to cryptocurrency wallet browser extension IDs, and secondary reporting adds MFA tools delivered as browser extensions. VirusTotal published the YARA rule win_dll_sideload_eosinophil_infostealer_jan26 and a public collection. The report names no malware family, no C2 infrastructure, no exfiltration channel and no threat actor. Because the sources disclose no C2 IPs or domains, no BeaconBeagle correlation was possible. Severity is analyst-assigned.

## MITRE ATT&CK

- T1574.001 DLL
- T1574.001 DLL
- T1574.001 DLL
- T1204.002 Malicious File
- T1036.005 Match Legitimate Resource Name or Location
- T1684.001 Impersonation
- T1555.003 Credentials from Web Browsers
- T1005 Data from Local System

## Sources

- [New Infostealer Campaign Targets Users via Spoofed Software Installers (VirusTotal Blog)](https://blog.virustotal.com/2026/01/malicious-infostealer-january-26.html)
- [VirusTotal public collection for the campaign](https://www.virustotal.com/gui/collection/bb55b097341a5e6ed733c156b07c878c086b08ac40f7cfa31e6715c23dd0b3a7)
- [Fake Malwarebytes Campaign Exploits DLL Sideloading to Drop Infostealers (SecurityOnline)](https://securityonline.info/fake-malwarebytes-campaign-exploits-dll-sideloading-to-drop-infostealers/)
- [Threat Actors Impersonate as MalwareBytes to Attack Users and Steal Logins (Cryptika)](https://www.cryptika.com/threat-actors-impersonate-as-malwarebytes-to-attack-users-and-steal-logins/)
- [Malwarebytes: Threat Actors Impersonate Malwarebytes to Steal User Login Credentials (Rankiteo)](https://blog.rankiteo.com/mal1768834644-malwarebytes-cyber-attack-january-2026/)
- [VirusTotal Blog archive, January 2026](https://blog.virustotal.com/2026/01/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3939