GPU mining malware spreads via SEO poisoning, AI chatbots
Microsoft says a cryptojacking campaign used SEO poisoning and AI chatbot links to lure victims into downloading malware-laced utility installers.
Intelligence analysis by GPT-5.4 Mini
Microsoft tracked a cryptojacking operation that hid malware inside fake downloads for popular PC utilities, then boosted those pages with SEO poisoning and, in some cases, AI chatbot recommendations. The payload established persistence, evaded analysis, and ultimately deployed GPU miners.
A group of bad actors tricked people looking for common computer tools into downloading fake files. They also helped those fake links show up higher in search results, and some people were even led there by chatbots.
Once the fake file ran, it quietly installed software that let the attackers come back later. It was like putting a hidden spare key under the doormat, then covering the house with a fake welcome mat.
After that, the malware started using the computer’s graphics chip to make digital money for the attackers. It was built to avoid being noticed and to keep working for as long as possible.
Analysis
What happened
Microsoft researchers identified an ongoing cryptojacking campaign that targets high-performance computers. The lure was a set of fake download pages for familiar utilities such as CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec Pack, and PDFgear.
The traffic to those pages was not accidental. Microsoft says attackers used SEO poisoning to push malicious links higher in search results. The company also says some users were steered to attacker-controlled domains after asking AI chatbots for software download recommendations.
How the infection works
The malicious downloads were ZIP archives hosted on a subdomain of gleeze[.]com, a domain Microsoft says has previously been associated with phishing. Inside the archive was a legitimate executable plus a malicious DLL. When the benign program launched, the DLL was automatically loaded and used msiexec.exe to install a package that brought in ScreenConnect, a real remote management tool.
From there, the attacker gained persistent access and dropped another binary, SimpleRunPE.exe, which copied itself as RuntimeHost.exe into a hidden folder. Microsoft says the malware set up six persistence mechanisms across Windows autostart locations. In some cases, a malicious PowerShell script saved the payload locally as vlc.exe to impersonate the VideoLAN media player.
Evasion and mining
Microsoft says the sample appears to be based on public process-hollowing code. It attempted to hollow legitimate Microsoft-signed .NET binaries such as InstallUtil.exe, RegAsm.exe, RegSvcs.exe, MSBuild.exe, AppLaunch.exe, AddInProcess.exe, and aspnet_compiler.exe. It also tried to add its own path and process to Microsoft Defender exclusions.
The malware checked for virtual machines and for about 40 analysis-related process names. If it detected them, it quit. After the hollowing stage, the campaign downloaded one of three GPU miners: gminer, lolMiner, or SRBMiner-MULTI.
Microsoft’s main point is that this campaign is built to maximize mining yield per infected device, not to infect as many systems as possible. That makes the targeting strategy more deliberate and potentially more profitable than broad, noisy cryptomining spam.
Key points
- Attackers used SEO poisoning and, in some cases, AI chatbot recommendations to direct victims to malicious download pages.
- The fake installers targeted popular utilities often used on powerful PCs and gaming systems.
- The malware installed ScreenConnect, then added multiple persistence mechanisms to stay on the machine.
- It used process hollowing and Defender exclusions to reduce detection.
- The final payload deployed GPU miners such as gminer, lolMiner, and SRBMiner-MULTI.
