The Argamal malware is a remote access trojan distributed via installers for adult video games on websites, file-sharing platforms, and torrent trackers. The disguised installers execute a PowerShell script to evade detection, establish a C2 connection after a delay, and achieve persistence by hijacking the Windows Color System Calibration Loader. Once active, it steals sensitive data, including files, financial information, and live video streams, with observed infections concentrated in Russia, Brazil, Germany, and Vietnam.
Malware New Argamal malware disguised as adult games targets users June 15, 2026 Share By SC Staff (Adobe Stock) A new malware campaign, identified as Argamal, is targeting individuals downloading adult video games. Detected in April 2026 by Kaspersky, this remote access trojan (RAT) is hidden within installers of hentai games, allowing attackers to gain remote control over infected computers, according to a recent report by HackRead. The Argamal malware is distributed through adult game websites, file-sharing platforms, and torrent trackers. Infected installers contain fully functional games, making them appear legitimate. Upon launching, the malware executes a PowerShell script that checks for security tools before establishing a connection to attacker-controlled servers. After a three-day delay, it downloads and decrypts its main module using AES-CBC encryption. Argamal ensures persistence by hijacking Windows Color System Calibration Loader, allowing it to run every time a user logs in. Once active, it can steal files, access private chats, gather financial data, take screenshots, alter crypto-wallet addresses, and stream live video. Kaspersky has identified hundreds of infections, primarily in Russia, Brazil, Germany, and Vietnam, with indications that the attackers speak Spanish. Notably, the malware avoids targeting users in China. Source: HackRead SC Staff Related Malware OnyxC2 stealer sold as a service targets over 210 applications SC Staff June 11, 2026 OnyxC2 is being sold on cybercrime forums for as little as $250 per month, with developers offering refunds if their builds are detected, highlighting confidence in its evasion capabilities. Malware Malicious podcast, PDF apps spread FlutterShell macOS backdoor malware Laura French June 5, 2026 FlutterShell is linked to previous malvertising campaigns including TamperedChef. Malware New malspam campaign uses Google DoubleClick to deliver DesckVB RAT SC Staff June 4, 2026 The campaign begins with a phishing email containing an HTML attachment. Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Adware You can skip this ad in 5 seconds