Microsoft warns that GPU mining malware is being spread through SEO poisoning and AI chatbots — cryptojacking campaign targets gamers and high-end PC users with downloads disguised as popular PC utilities

Microsoft says an active cryptojacking campaign used SEO poisoning and, in some cases, AI chatbot links to lure users into fake utility downloads.

The malware impersonated tools like CrystalDiskInfo, HWMonitor, FurMark, K-Lite Codec Pack, and PDFgear, targeting gamers and other high-end GPU owners.

Victims downloaded malicious ZIP files that used DLL sideloading, persistence, remote-access software, and process injection to install hidden mining payloads.

The campaign installed miners such as lolMiner, gminer, and SRBMiner-MULTI to quietly exploit infected systems for GPU mining.