Winos4.0 abuses gaming apps to infect, control Windows machines

Criminals are distributing a multi-stage Windows malware framework named Winos4.0 hidden in game installers and optimization utilities; the attack chain uses staged DLLs and shellcode to establish persistence (registry storage), perform reconnaissance and data theft (screenshots, documents, wallet extensions), and maintain a C2 backdoor. Fortinet links the malware to multiple campaigns including activity associated with the Silver Fox group, and warns users to obtain applications from trusted sources.