Malware Distribution via Fake Video Player Updates on Pirated Streaming Sites

• •Malware is distributed via fake updates on illegal streaming sites.
• •The infection method has been active since at least 2022 and affects millions of users.
• •The campaign has adapted its delivery mechanisms while maintaining high traffic levels.

In late April 2026, a cybercrime gang exploited illegal streaming platforms to distribute malware, primarily a miner and RAT, through fake video player updates. Users attempting to watch pirated content encountered alerts claiming their video player plugin was outdated, leading them to download a malicious ZIP file containing a legitimate executable and a harmful DLL. This infection vector has been active since at least 2022, with the malware delivered through popular pirated sites that attracted millions of visitors monthly. The sites linked to this campaign had a total of 40 million visits in April 2026. The threat actor has adapted their delivery mechanism, moving from a previously used domain to a new one, while maintaining the structure of the malicious archive. The ongoing campaign poses a significant risk to users of these platforms, as many remain unaware of the malware's presence.