Kaspersky analysts have revealed that cybercriminals use unlicensed software websites to install trojans designed to steal user data in the region. First detected in March 2025, this threat has affected users in various regions, including Latin America, extending the risk from the gaming community to professionals seeking unlicensed design or productivity software. Although the malware was initially identified as spreading through 'cracked' games, Kaspersky analysts discovered dozens of websites created specifically to spread this loader. Subsequently, the system uses HijackLoader to download additional threats such as Lumma Stealer, ACR Stealer, or Vidar Stealer, which specialize in stealing sensitive information. Leandro Cuozzo, a Security Analyst in Kaspersky's Global Research and Analysis Team for Latin America, stated that cybercriminals have expanded their tactics by using cracked productivity software. The HijackLoader component is identified as Trojan.Win32.Penguish and Trojan.Win32.DllHijacker, enabling the active blocking of these illicit activities. To reduce the risk of infection, Kaspersky experts recommend: downloading games and programs exclusively from official sources and avoiding pirated software; distrusting paid applications offered for free on unknown sites; keeping the operating system and all applications updated to fix vulnerabilities; using a reliable security solution that can detect suspicious behavior in real-time. The institution emphasizes that prevention is fundamental against opportunistic attacks that seek to exploit the download of unlicensed content to compromise the privacy and digital assets of users in the region.
