Fake Tools and CDNs Power New “Vibe-Coded” Malware Campaign

McAfee Labs uncovered a large "vibe-coded" malware campaign distributing over 440 malicious ZIP archives that masquerade as legitimate AI tools, game mods, drivers, and utilities; these trojanized packages sideload a WinUpdateHelper.dll which executes in-memory PowerShell to deploy cryptocurrency miners (and sometimes stealers/RATs), use time-based C2 domains and persistence as a fake Windows service, and employ evasion techniques such as user-agent filtering and Defender exclusion manipulation.