Fake downloads of popular PC utilities are quietly installing crypto miners on enthusiast PCs

Microsoft says a cryptomining campaign is using SEO poisoning, fake download pages, and misleading AI-generated links to target Windows users searching for popular utilities.

Victims download malicious archives that install ScreenConnect and other payloads, then run miners when the PC is idle.

The campaign mainly targets high-end GPU systems, making enthusiast and benchmarking PCs especially attractive.

Microsoft warns that misinformation from search results and chatbots can lead users to hidden compromise on trusted maintenance tools.