Researchers have identified a new malicious malware bundle developed for Windows machines that drops both infostealing and cryptomining malware on victim devices. Active since at least February 2023 but just recently discovered, SteelFox is a malware dropper that uses a “bring your own vulnerable driver” technique to establish SYSTEM privileges on the victim Windows machine. SteelFox is delivered via cracked software such as Foxit PDF Editor, JetBrains, and AutoCAD. The software download does indeed contain the cracked version of the software, but it also includes the SteelFox malware. The admin access required to install the software is abused to create a service that runs a version of WinRing0.sys with two known vulnerabilities that are exploited to give the attacker NT\SYSTEM privileges. This driver is also a component of XMRig miner which is used by the attacker for cryptojacking, connecting to a mining pool with hardcoded credentials. The SteelFox malware uses SSL pinning and TLS v1.3 to establish a command-and-control connection. SteelFox is capable of harvesting and exfiltrating data from a wide variety of web browsers to access stored information such as cookies, credit cards, location, and search history. To date, researchers have identified compromised systems primarily in countries including Brazil, China, Russia, and Mexico. CTIX analysts advise organizations and individuals to refrain from downloading software through illegitimate channels. CTIX analysis will continue to report on new and emerging forms of malware and associated campaigns.