Fake Malwarebytes Campaign Exploits DLL Sideloading to Drop Infostealers

A recent campaign (observed Jan 11–15, 2026) distributes fake installers named like malwarebytes-windows-github-io-X.X.X.zip that use DLL sideloading—dropping a malicious CoreMessaging.dll alongside legitimate signed EXEs—to run secondary-stage info-stealers. Analysts linked samples by a common behash (4acaac53c8340a8c236c91e68244e6cb) and discovered distinctive metadata and pivot files tying the operation to other fake installers; the malware targets cryptocurrency assets and MFA credentials.