Fake OnlyFans cybercrime tool infects hackers with malware

**Executive Summary:** Veriti Research uncovered a deception campaign where a malicious OnlyFans 'checker' executable (brtjgjsefd.exe) hosted on GitHub installs the Lumma stealer; the operator (GitHub user "UserBesty") hosts additional fake checkers (DisneyChecker.exe, InstaCheck.exe, ccMirai.exe) and uses .shop domains as command-and-control, enabling credential, cookie, 2FA, and cryptocurrency wallet theft as well as additional payload loading.