‘Vibe-Coded’ Malware Campaign Uses Fake Tools, CDNs and File Hosts to Infect Users

In January 2026 researchers uncovered a widespread malware campaign distributing hundreds of trojanized ZIP files (443+ samples) across platforms like Discord, SourceForge, MediaFire and others; each package dropped a malicious DLL called WinUpdateHelper.dll that performs DLL sideloading, registers persistence as a Windows service, uses in-memory PowerShell and dynamically generated C2 domains, and deploys coin miners and infostealers/RATs while leveraging social-engineered lures and legitimate third-party installers as distractions.