A Pakistani cybercrime group has been linked to a global operation that spread infostealer malware through pirated software downloads. The scheme infected millions of devices worldwide and generated millions of dollars in profit over five years.
How the Attack Worked
The attackers relied on SEO poisoning and forum posts to lure victims searching for cracked software like Adobe After Effects and Internet Download Manager.
-
Victims were redirected to malicious WordPress sites.
-
Malware, including Lumma Stealer, Meta Stealer, and AMOS, was hidden in password-protected archives.
-
Disposable domains masked the true origin of the infection.
Affiliate-Driven Malware Business
At the heart of the operation were two Pay-Per-Install (PPI) networks:
-
InstallBank and SpaxMedia (later renamed Installstera).
-
Affiliates earned payouts for each successful installation or download.
-
Over 5,200 members ran at least 3,500 malicious sites.
Scale of the Operation
CloudSek researchers found evidence of:
-
449 million clicks on poisoned links.
-
1.88 million malware installs.
-
More than $4 million in revenue, laundered via Payoneer and Bitcoin.
When Hackers Hacked Themselves
The campaign took an unexpected twist when the cybercriminals were infected by the same malware they distributed.
-
Their own credentials, backend systems, and communications were leaked.
-
Evidence suggested family involvement, with shared accounts and recurring surnames.
Evolving Strategies
-
Initially, affiliates were paid per installation (2020 model).
-
Later, they shifted to download-based tracking, likely to avoid detection and adapt to new monetization methods.
-
Long-running sites proved most lucrative, while disposable domains added deniability and reduced traceability.
Why This Matters
The case underscores the serious risks of downloading cracked or pirated software, which often serves as a gateway to malware.
How to Stay Protected
-
Download only from official developer websites or trusted platforms.
-
Keep antivirus and firewalls updated.
-
Use multi-factor authentication to protect accounts.
-
Monitor financial and online accounts for suspicious activity.
-
Back up data regularly to secure storage.
-
Stay alert to new cyber threats and avoid “too good to be true” offers of free software.