A newly identified cryptojacking campaign that spreads through pirated software installers has been uncovered by researchers, revealing a multi-stage infection chain designed for persistence, stealth and maximum cryptocurrency mining output.<\/p>\n
The operation, discovered by security firm Trellix, centres on a customised XMRig miner and a controller component that maintains long-term access to infected systems.<\/p>\n
Unlike earlier browser-based cryptojacking schemes<\/a>, this campaign deploys system-level malware. It relies on deceptive installers masquerading as office productivity software, luring users with free premium applications.<\/p>\n Once executed, the dropper installed a primary controller named Explorer.exe in the user directory and initiated a staged deployment of mining and persistence components.<\/p>\n The controller functioned as a state-driven orchestrator rather than a simple loader. Depending on command-line arguments, it could install, monitor, relaunch or remove components.<\/p>\n Trellix found references to the anime Re:Zero – Starting Life in Another World<\/em> embedded in the code, including a "002 Re:0" parameter that activates the main infection mode and a "barusu" argument that triggered a structured cleanup routine.<\/p>\nModular Design Enhances Resilience<\/strong><\/h3>\n