An emerging campaign was recently discovered by Kaspersky researchers spreading the “NullMixer” malware. NullMixer exfiltrates victims’ credentials, addresses, credit card data, cryptocurrencies, as well as Facebook and Amazon account credentials by capturing all information entered with the device’s keyboard. Researchers emphasized that currently 47,500 individuals have been attacked with NullMixer and the malware is distributed by cracked software websites. The operators of NullMixer were observed using “professional SEO [search engine optimization] tools” in order to have their websites appear in the early results of an online search. It is common for those downloading content illegally to receive adware or other low-end malware, but NullMixer is described as “far more dangerous” due to its ability to download many malicious files at once (such as “downloaders, spyware, backdoors, bankers and other threats”), potentially leading to a large-scale infection of a victim network. The infection chain involves the victim attempting to download software from a malicious site and repeatedly being redirected to a page containing a password-protected archived program with detailed instructions. Following the instructions leads the victims to downloading NullMixer, which has the potential of downloading infamous malware such as “RedLine Stealer” and “Disbuk” (also known as “Socelar”). Researchers noted that the most targeted countries of this campaign are the United States, Germany, France, Italy, Turkey, Russia, Egypt, India, and Brazil. CTIX analysts recommend all users download legitimate software from trustworthy websites to help mitigate the risk of threat actors utilizing their machine as an initial access point into their network.