PSA: PC enthusiasts downloading tools like Display Driver Uninstaller, CrystalDiskInfo, or similar utilities should take a closer look at where those downloads are actually coming from. Microsoft has uncovered an active cryptocurrency mining campaign targeting the kinds of high-end machines most likely to run benchmarking and maintenance software.
The Windows Defender security team is alerting users with dedicated GPUs about scammers manipulating search engine results to distribute remote monitoring and cryptomining payloads. The hackers are manipulating not only search engine results but also AI chatbot responses.
Scammers are using SEO poisoning techniques to direct users to fraudulent copycat sites when they search for CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec Pack, PDFgear, and other tools.
Most cryptojacking campaigns cast as wide a net as possible, but the operation Microsoft identified in April takes a more deliberate approach: it specifically targets people looking for GPU analysis, driver maintenance, and benchmarking software – precisely the class of hardware that's most capable of mining cryptocurrency.
Hijacking search engine results is nothing new, but reports on Reddit, along with traffic metadata, suggest that hackers are also tricking AI chatbots into giving users fraudulent links.
