--- title: They stole my video to promote Malware? | daily.dev description: A security researcher discovers their video was stolen and repurposed to promote a fake game cheat distributing malware. The analysis covers the full infection... canonical: https://daily.dev/posts/they-stole-my-video-to-promote-malware--hmclb7bny twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: They stole my video to promote Malware? | daily.dev og:description: A security researcher discovers their video was stolen and repurposed to promote a fake game cheat distributing malware. The analysis covers the full infection... og:url: https://daily.dev/posts/they-stole-my-video-to-promote-malware--hmclb7bny og:image: https://api.daily.dev/og/posts/hMclb7BnY.png og:image:alt: They stole my video to promote Malware? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # They stole my video to promote Malware? **[Eric Parker](https://daily.dev/sources/ericparker)** · 19 min read · 0 upvotes · 0 comments ## Summary A security researcher discovers their video was stolen and repurposed to promote a fake game cheat distributing malware. The analysis covers the full infection chain: a ZIP containing an NSIS installer that deploys an Electron app, which decrypts a payload disguised as a Chinese language pack, protected by Themida with strong anti-VM and anti-sandbox techniques. Static analysis is largely defeated by the packer, but GPT-based unpacking yields the native payload. The malware is an information stealer targeting browser data, crypto wallets (including obsolete ones like Bytecoin and Namecoin), and browser extensions, with C2 resilience via Ethereum-based 'EtherHiding' to rotate command-and-control addresses. The researcher dubs it 'OGStealer' due to its targeting of legacy cryptocurrencies. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding](https://daily.dev/posts/fake-games-spread-stealers-with-renpy-loader-msbuild-and-etherhiding-zkfrqypzs) · Security Boulevard · 0 upvotes · 0 comments - [New BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages](https://daily.dev/posts/new-boryptgrab-stealer-targets-windows-users-via-deceptive-github-pages-yrwqhjw1f) · Trend Micro · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware), [#reverse-engineering](https://daily.dev/tags/reverse-engineering) [View this post on daily.dev](https://daily.dev/posts/they-stole-my-video-to-promote-malware--hmclb7bny) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"They stole my video to promote Malware?","url":"https://daily.dev/posts/they-stole-my-video-to-promote-malware--hmclb7bny","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/they-stole-my-video-to-promote-malware--hmclb7bny"},"datePublished":"2026-07-31T15:30:37.319Z","dateModified":"2026-07-31T15:30:57.569Z","description":"A security researcher discovers their video was stolen and repurposed to promote a fake game cheat distributing malware. The analysis covers the full infection...","image":"https://i.ytimg.com/vi/U12-kj7DWTM/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/U12-kj7DWTM/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Eric Parker","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Eric Parker","logo":"https://media.daily.dev/image/upload/s--vVcOpkjx--/f_auto/v1724391603/logos/ericparker","url":"https://daily.dev/sources/ericparker"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/they-stole-my-video-to-promote-malware--hmclb7bny","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,malware,reverse-engineering","timeRequired":"PT19M","video":{"@type":"VideoObject","name":"They stole my video to promote Malware?","description":"A security researcher discovers their video was stolen and repurposed to promote a fake game cheat distributing malware. The analysis covers the full infection...","thumbnailUrl":"https://i.ytimg.com/vi/U12-kj7DWTM/sddefault.jpg","uploadDate":"2026-07-31T15:30:37.319Z","duration":"PT19M","url":"https://api.daily.dev/r/hMclb7BnY","embedUrl":"https://www.youtube.com/embed/U12-kj7DWTM"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Eric Parker","item":"https://daily.dev/sources/ericparker"},{"@type":"ListItem","position":3,"name":"They stole my video to promote Malware?"}]} ```