Sophisticated GPU Cryptojacking Campaign Surfaced by Microsoft Experts

Microsoft Defender experts report a targeted GPU cryptojacking campaign that poisons search engine and AI-assisted results to distribute trojanized utilities (impersonating tools like CrystalDiskInfo/FurMark). The malware uses DLL sideloading (autorun.dll), process hollowing of signed binaries (e.g., MSBuild.exe), multiple persistence mechanisms (registry Run keys, three scheduled tasks), ScreenConnect abuse for secondary payload delivery, anti-analysis checks and self-repair routines, and dynamically streams popular GPU miners (gminer/lolMiner) to maximize GPU mining yield on powerful gaming rigs.