Microsoft says malvertising campaign impacted 1 million PCs

Microsoft disrupted a widespread malvertising campaign (tracked as Storm-0408) that redirected users of pirated streaming sites to malicious GitHub repositories and other hosts (Dropbox, Discord), resulting in multi-stage infections that perform system discovery, credential and data exfiltration, and deployment of NetSupport RAT and information stealers (including Lumma and Doenerium). The attack chain used embedded video redirectors to funnel victims through additional redirectors and sites, dropped PowerShell and AutoIt-based payloads that establish persistence and disable protections, and impacted a broad set of consumer and enterprise devices worldwide (nearly one million devices reported).