Cybercriminals target graphic designers with GPU miners
Summary: Cisco Talos documented an ongoing illicit cryptomining campaign that abuses the legitimate Advanced Installer tool to bundle 3-D modeling and graphic design software installers with malicious PowerShell and batch scripts, dropping the PhoenixMiner and lolMiner GPU miners and, in some samples, the M3_Mini_Rat client stub. The attacks predominantly target users in France and Switzerland, with additional infections in the U.S., Canada, Algeria, Sweden, Germany, Tunisia, Madagascar, Singapore and Vietnam, and the attacker's Ethereum Classic wallets mined more than 50 ETC in January 2023 and more than 50 ETC on July 9, 2023 alone.
Key Takeaway: The campaign targets architecture, engineering, construction, manufacturing and entertainment firms precisely because their high-GPU workstations are valuable for mining, and the attacker has been running wallet addresses since 2021 - so the hardware your designers depend on is the asset being monetized.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026