Threat Actors Impersonate as MalwareBytes to Attack Users and Steal Logins

Security researchers observed an active campaign (Jan 11–15, 2026) distributing ZIP files named to resemble Malwarebytes installers; the archives contain a malicious CoreMessaging.dll used to perform DLL sideloading and drop infostealers that harvest browser-stored credentials and cryptocurrency wallet data. VirusTotal analysts identified a consistent behash value (4acaac53c8340a8c236c91e68244e6cb) and distinctive DLL metadata/exported strings that serve as tracking IOCs.