Fake Software Installers Used to Drop RATs and Monero Miners in Long

Cybersecuritynews •Tushar Subhra Dutta • April 7, 2026

A financially motivated threat actor has been running a quiet malware campaign since at least late 2023, tricking users into downloading fake software installers that secretly deliver remote access trojans (RATs) and Monero cryptocurrency miners. The operation, designated REF1695, has remained active for over two years, steadily expanding its toolset while staying under the radar […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ongoing Malware Campaign Using Fake Installers to Distribute RATs and Miners A financially motivated threat actor has been running a malware campaign since late 2023, utilizing fake software installers to deliver remote access trojans (RATs) and Monero cryptocurrency miners. This operation, known as REF1695, has been active for over two years and has expanded its toolset while remaining largely undetected. The attackers employ ISO-based fake installers that mimic legitimate software setup packages, tricking users into downloading them. Once executed, these installers do not deliver the promised applications but instead install malicious software. The campaign has affected a wide range of users, particularly those seeking software downloads online. The current status indicates that the operation is still ongoing, with no signs of mitigation reported. Security professionals are advised to be vigilant against these types of threats and educate users on the risks of downloading software from unverified sources. 2 sources 52

Fake Software Installers Used to Drop RATs and Monero Miners in Long

The full story

Extracted Entities

Attack Types (2)

Campaigns (1)