New Malware Exploits Windows Character Map to Evade Defender and Mine Crypto

A sophisticated cryptojacking campaign hijacks Windows’ native Character Map utility (charmap.exe) to evade Defender and covertly mine cryptocurrency on compromised machines, first detected in late August 2025.

The threat chain starts with a spear-phishing email containing a malicious shortcut disguised as a PDF, which, when opened, runs PowerShell to fetch an obfuscated dropper that writes two payloads into the user’s AppData folder: an AutoIt Loader that injects the miner into charmap.exe and a 64‑bit mining binary that connects to a remote mining pool over TCP port 3838.

To maintain persistence, the campaign creates a scheduled task named “WindowsCharMapUpdater” and drops a DLL in AppData while subverting werfault.exe via DLL side-loading so the miner restarts after reboots or terminations. Infections impact organisations from small businesses to large enterprises, with the highest rates in healthcare and education, and victims commonly see CPU and GPU utilisation exceed 80 per cent.

Mitigations emphasise anomaly-based detection alongside traditional tools, with Darktrace reporting multiple connection attempts aborted and advising monitoring for unusual PowerShell arguments and outbound mining connections, plus application-allowlisting and strict PowerShell execution policies.