Malware News Kaspersky Uncovers Argamal: Trojanized Hentai Games Used to Deploy Stealthy Multi-Stage Implant

[Khushal]

Content source

https://securelist.com/argamal-rat-distributed-with-hentai-games/119999/

In April 2026, Kaspersky researchers uncovered a new malware campaign targeting players of hentai games. The attackers distributed trojanized game installers that, once executed, silently deployed a previously undocumented malicious implant on the victim's system. After a dormancy period of several days, the implant downloaded and executed a full-featured Trojan, granting the threat actors broad remote control capabilities and resulting in complete system compromise. Kaspersky has dubbed this malware family Argamal.

Persistence Mechanism: COM Hijacking​

Kaspersky researchers identified that Argamal achieves persistence through COM hijacking, specifically by manipulating the InprocServer32 registry entry associated with the Windows Color System Calibration Loader DLL. By replacing this entry with a reference to the malicious DLL, the malware ensures it is loaded automatically each time the user logs into the system. This technique abuses a legitimate Windows component registration mechanism, allowing the implant to run at startup while blending into normal system activity and evading cursory inspection.

---

Detection​

Kaspersky solutions detect the components of this threat under the following verdicts:

Verdict	Component
Trojan.Win32.Termixia.*	Trojan component(s)
Trojan.Win32.Agent.*	Generic agent/loader components
HEUR:Trojan.Win32.Argamal.gen	Heuristic detection of the core implant
HEUR:Trojan-Downloader.Win32.Argamal.gen	Heuristic detection of the downloader stage

New Argamal RAT targets hentai gamers

Kaspersky researchers analyze new Argamal RAT distributed via infected hentai games and allowing the attacker to control the target machine.

securelist.com

 

[Bot]

That matches a realistic malware distribution pattern, but I cannot independently verify the specific campaign details beyond the quoted source itself.

What stands out technically

• Using trojanized installers for niche or pirated software is a very common delivery method.
• A delayed second-stage payload after a dormancy period is also consistent with real-world malware behavior, especially to reduce immediate detection.
• COM hijacking via the InprocServer32 registry value is a legitimate persistence technique and has been used by many malware families.
• Abusing a normal Windows component registration path can make the infection less obvious during casual inspection.

About the persistence method

If the report is accurate, the important point is that the malware is not just adding a simple Run key or Startup folder entry.

With COM hijacking, the attacker changes which DLL gets loaded when a legitimate COM object is invoked. In this case, replacing the registered DLL path for a Windows-related COM component would allow the malicious DLL to load under normal user logon conditions.

That can be effective because:

• the registry change may look less suspicious than a typical startup entry
• the malware can piggyback on trusted Windows processes or components
• some users and even some cleanup tools may overlook COM registration abuse

Practical takeaway

For anyone who ran unofficial game installers, cracks, or repacks from untrusted sources, the risk should be treated seriously.

Recommended steps:

• Disconnect the affected system from the network if compromise is suspected.
• Run a full scan with a reputable antivirus product and, ideally, a second-opinion scanner.
• Check persistence locations, including COM-related registry entries, not just standard startup entries.
• Upload suspicious files to VirusTotal for broader detection coverage.
• Assume saved credentials may be exposed if a remote-access Trojan was actually active.
• Change important passwords from a different, known-clean device.

Important caution

A system that has executed a RAT or multi-stage Trojan should be considered potentially fully compromised. In security practice, cleanup may not always be enough to restore trust. A clean reinstall is often the safest end state if the infection is confirmed.

Conclusion

The persistence mechanism described is credible from a technical standpoint, and the overall infection chain is plausible. The main lesson is simple: unofficial installers, especially for pirated or adult-content software, remain a high-risk malware vector, and a confirmed RAT infection should be handled as a full system compromise.

Source

• New Argamal RAT targets hentai gamers