Threat Actors Weaponized Pirated Games to Bypass Microsoft Defender SmartScreen and Adblockers

Cybercriminals have successfully weaponized pirated gaming content to distribute sophisticated malware while bypassing popular security measures, including Microsoft Defender SmartScreen and widely-used adblockers.

The campaign leverages trusted piracy platforms to deliver HijackLoader, a modular malware framework that has become increasingly prevalent in the cyberthreat landscape.

The attack begins when users visit seemingly legitimate piracy sites like Dodi Repacks, which maintains a reputation as “safe” within piracy communities.

Users are often advised that installing adblockers like uBlock Origin provides adequate protection, creating a false sense of security.

However, recent analysis reveals that these protective measures prove insufficient against the sophisticated redirect chains employed by threat actors.

Trellix researchers identified that the malware distribution network operates through a complex series of redirects, starting with legitimate-looking download links that route users through domains such as zovo.ink and downf.lol.

These intermediate sites ultimately direct victims to MEGA file-sharing platforms hosting malicious archives.

The researchers noted that this technique effectively circumvents both SmartScreen protection and adblocker filtering, as the malicious content appears to originate from trusted file-sharing services.

The downloaded archives contain HijackLoader, a highly sophisticated multi-stage malware loader that employs numerous advanced evasion techniques.

Upon execution, the malware deploys bloated DLLs exceeding 680MB in size to prevent analysis by automated sandboxes and security tools that impose file size limitations.

The infection chain involves multiple configuration files, including quintillionth.ppt and paraffin.html, which contain encrypted payload data and execution parameters.

Advanced Evasion and Persistence Mechanisms

HijackLoader demonstrates remarkable technical sophistication through its implementation of advanced evasion techniques that challenge traditional security approaches.

The malware employs module stomping, a technique where legitimate system DLLs like shell32.dll are overwritten with malicious code, effectively hiding the payload within trusted system components.

The loader utilizes a technique called “Heavens Gate” to perform direct system calls, bypassing user-mode API hooks commonly deployed by security solutions.

This approach involves transitioning from 32-bit to 64-bit execution contexts to invoke Windows Native API functions directly.

Additionally, the malware implements stack spoofing by replacing return addresses with legitimate function pointers from system DLLs, making the call stack appear benign during runtime analysis.

// Stack spoofing implementation example
cur_stack_base_addr = (_DWORD *)*cur_stack_base_addr;
if (mw_is_within_k32_or_ntdll_text_section_bounds(stack_information, *current_frame_return_addr)) {
    counter2 = counter1 + 1;
} else {
    mw_save_detected_stack_address(stack_information, cur_stack_base_addr + 1);
}

The malware’s modular architecture supports over 40 different modules, enabling deployment of various final payloads including LummaC2 stealer, Redline Stealer, and Rhadamanthys.

This campaign demonstrates how threat actors continue to exploit user trust in piracy platforms while simultaneously evolving their technical capabilities to evade modern security solutions.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.