Blitz Malware: A Tale of Game Cheats and Code Repositories
Summary: Unit 42 discovered Windows malware called Blitz, consisting of a downloader and a bot payload that performs keylogging, screenshot capture and denial-of-service against web servers, and found a new version in early 2025 indicating active development. The latest version spread through backdoored game cheats for Standoff 2 named Nerest_CrackBy@sw1zzx_dev.zip and Elysium_CrackBy@sw1zzx_dev.zip, distributed via a Telegram channel created by an operator using the moniker sw1zzx, with C2 infrastructure and files hosted on Hugging Face Spaces and a Monero cryptocurrency miner delivered as follow-up malware.
What's compelling: The operator abused Hugging Face Spaces, a mainstream AI code repository, to host malware and C2 data, and by early May 2025 announced their departure while Hugging Face locked the account and blocked the bot file's blob ID - a reminder that trusted developer platforms can serve as staging infrastructure.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026