Fake Streaming Site Spreading Proxyware

This report details an active campaign where threat actors host a fake streaming site that distributes a customized Proxyware (CoinSurf) dropper for Windows; the malware uses Squirrel for installation, disables Defender via Add-MpPreference exclusions, establishes persistence via HKCU Run, authenticates to the CoinSurf service to aggregate infected hosts under the attacker’s profile, and includes file hashes, domain/URI IOCs and MITRE technique mappings.