Beware of malicious mining code in software downloaded from unofficial channels

Dimensionality Security Lab (johnwick.io) recently noticed a malicious campaign that infected users to mine cryptocurrencies. In order to infect users worldwide, hackers created a malicious clone of PDFescape and made a detail modification: the attacker decompiled and modified an MSI file (an Asian font package) and then added a malicious payload containing crypto mining code. According to statistics, a total of 12,810 users in 100 countries were infected by this malware.