Fake Malwarebytes Campaign Exploits DLL Sideloading to Drop Infostealers

A new malware campaign masquerading as legitimate software installers has been uncovered, with threat actors impersonating Malwarebytes to drop information-stealing payloads. The operation was observed between 11 and 15 January 2026, identified through a set of malicious ZIP archives that rely on social engineering to persuade users to run them.

Instead of a direct malicious executable, the attackers use a DLL sideloading technique, bundling a malicious CoreMessaging.dll with a legitimate executable so that the system loads the DLL when the trusted program runs; a fingerprint for the campaign’s initial stage is a behavioural hash, 4acaac53c8340a8c236c91e68244e6cb.

The endgame is the deployment of secondary-stage infostealers, described as BrowserStealerGeneric, with targets including cryptocurrency assets and MFA tools, and the campaign has been linked to other fake installers for software such as Logitech G Hub, OpenIV and Asus Armoury Crate. Researchers noted unique metadata within the DLLs and a number of identifying strings in the archives, strengthening the case for a coordinated campaign rather than isolated incidents.