ViperSoftX Malware Disguises as eBooks on Torrents to Spread Stealthy Attacks

ViperSoftX, an information-stealing malware first observed in 2020, is being distributed via malicious eBook RAR archives on torrent sites; the campaign uses deceptive Windows shortcut lures that trigger a multi-stage chain (AutoIt → .NET CLR → PowerShell) to decrypt and execute the stealer. The variant exploits AutoIt UDFs to host PowerShell, patches AMSI, employs anti-analysis and persistence techniques, harvests system data, cryptocurrency wallets, and clipboard contents, and can download additional payloads such as Quasar RAT and TesseractStealer.