WinUpdatehelper.dll first sample mentioned in report:
VirusTotal
www.virustotal.com
The Big Picture
McAfee Labs researchers discovered a large-scale malware campaign in January 2026 where attackers used AI to help write parts of their malicious code — a technique being called "vibe-coded malware."
What is vibe coding? The term was coined in February 2025 by OpenAI researchers. It describes an approach where the AI does the heavy lifting: instead of manually writing code, users describe their intent through text prompts and LLMs respond with fully functional code. Cybercriminals have now turned this against us.
Scale of the Attack
In January 2026, McAfee Labs observed 443 malicious ZIP files impersonating a wide range of software — AI image generators, voice changers, stock-market tools, game mods, game hacks, GPU drivers, ransomware decryptors, VPNs, and even other stealers and backdoors.
Across these 440+ ZIP files, researchers found 48 unique malicious WinUpdateHelper.dll variants responsible for the infections, distributed through legitimate platforms like Discord, SourceForge, FOSSHub, and MediaFire.
The campaign specifically targeted users in the US, UK, India, Brazil, France, Canada, and Australia.
How the Attack Works (The Kill Chain)
Step 1 — The Lure: Victims search for tools online and instead download trojanized ZIP files. The executable inside appears legitimate, while a hidden malicious DLL called WinUpdateHelper.dll does the actual damage.
Step 2 — Misdirection: When run, the malware tells users they're missing dependencies and redirects them to a file-hosting site. While the victim is distracted downloading unrelated third-party software, the DLL has already connected to the attacker's command-and-control (C2) server.
Step 3 — The Payload: The C2 server delivers a PowerShell script that runs entirely in memory — a fileless execution technique designed to evade signature-based detection. The script then downloads cryptocurrency mining software and begins mining using both the CPU and GPU.
The AI Fingerprint
This is the most jaw-dropping part. Within the PowerShell scripts, researchers found structured, explanatory-style comments that strongly indicate large language models were used during development — including a comment reading
"# I am forever sorry" and similar guilt-laden notes like
"# sorry lol" scattered across multiple scripts.
One comment even reads
"Downloads cvtres.exe from your GitHub URL" — where "your GitHub URL" is a placeholder left over from AI-assisted code generation, pointing to the threat actor's own repository hosting the malware.
Following the Money
The campaign mined multiple cryptocurrencies including Ravencoin, Zephyr, Monero, Bitcoin Gold, Ergo, and Clore. Attackers used a clever strategy: mine Ravencoin (easier on victim hardware) and auto-convert rewards to Bitcoin before payout, since Bitcoin offers higher liquidity.
Because Bitcoin's blockchain is fully traceable, McAfee researchers were able to identify 7 wallets actively receiving mined cryptocurrency. As of the report, those wallets held approximately
$4,536 USD, with total funds received across the campaign amounting to roughly
$11,497 USD.
Anti-Analysis Tricks
The C2 server uses a domain name that rotates every 58 days, generated dynamically using the UNIX timestamp. The server also actively checks the User-Agent of incoming requests and only delivers the payload when the request comes from PowerShell — blocking researcher tools like Curl.
Additionally, the download URLs embedded in the PowerShell scripts are unique to each victim and expire after just
60 seconds, returning a 404 error to anyone trying to analyze them after the fact.
The Bigger Takeaway
The availability of LLMs capable of generating code instantly, combined with widespread accessibility of technical knowledge, has created a low-effort, high-reward environment — making malware deployment increasingly accessible to people with little technical background.
The barrier to becoming a cybercriminal is now as low as knowing how to type a prompt.
