⚠️ A cybercrime campaign since 2023 spreads malware via fake installers.

REF1695 delivers RATs, crypto miners, and CNB Bot via ISO files, tricks users to bypass Windows protections, and uses GitHub to host payloads.

�� Key tactics, payloads, and earnings → https://thehackernews.com/2026/04/researchers-uncover-mining-operation.html