Winos4.0 Malware Spread Through Game Apps Targets Education Sector

FortiGuard Labs identified Winos4.0, a sophisticated modular malware framework (an evolution of Gh0strat) spread via malicious game-related applications that download encoded BMP/DLL payloads from domains like ad59t82g.com; Winos4.0 establishes persistence via the Windows RUN registry key, injects shellcode, loads additional modules from C2, and exfiltrates system information, clipboard contents, and crypto-wallet data (e.g., MetaMask, OKX).