Hackers Hide New Argamal Malware Inside Working Hentai Games

Kaspersky uncovered an active campaign (April 2026) distributing a remote access Trojan called Argamal hidden in fully functional hentai game installers distributed via adult sites, file-sharing platforms and torrent trackers; the dropper abuses a rigged FFmpeg DLL and a PowerShell script, checks for analysis environments, delays execution, downloads an AES-CBC encrypted payload from GitHub, persists via COM hijacking of the Windows Color System Calibration Loader, and gives attackers full remote control and data-theft capabilities; hundreds of infections were observed across Russia, Brazil, Germany and Vietnam, with domains and filenames provided as IOCs.