Bookworms beware — this sneaky malware disguises itself as ebooks

Best ereader
Kom igång med din digital läsning med en av de bästa läsplattorna från Amazon, Kobo och mer. (Image credit: TechRadar / Amazon)

Researchers have warned reading fans of a new malware strain disguising itself as eBooks, and being distributed via torrents.

Usually, threat actors sharing malware via torrents would disguise the files as popular movies, or cracks for expensive, commercial software, since these are popular and allow the attackers to distribute the malware to a wider cohort. eBooks are not usually impersonated in cybercrime due to the files being somewhat niche.

However, cybersecurity researchers from Trellix say they have observed malware known as ViperSoftX being shared this way. Users would think they are downloading an eBook, but the archive would also carry a hidden folder and a Windows shortcut file. Running the shortcut triggers the infection chain, which results in the deployment of the malware. 

Information stealer and remote access trojan

ViperSoftX is a type of malware that functions as an information stealer and a remote access trojan (RAT). It is designed to steal sensitive information, such as login credentials, financial information, and other personal data from infected computers. 

It was first spotted in the wild around late 2019, and has since evolved with various updates and modifications, making it a persistent threat to computer systems. Newer versions steal cryptocurrency wallet data from browser extensions, grabs clipboard content, and more.

"A notable aspect of the current variant of ViperSoftX is that it uses the Common Language Runtime (CLR) to dynamically load and run PowerShell commands, thereby creating a PowerShell environment within AutoIt for operations," the researchers said, explaining how the malware remains hidden. "By utilizing CLR, ViperSoftX can seamlessly integrate PowerShell functionality, allowing it to execute malicious functions while evading detection mechanisms that might otherwise flag standalone PowerShell activity."

While a potent infostealer in its own right, ViperSoftX also served as a loader, helping threat actors distribute Quasar RAT and an infostealer called TesseractStealer, TheHackerNews reports. 

More from TechRadar Pro

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
A digital representation of a lock
Security experts are being targeted with fake malware discoveries
DeepSeek
Fake DeepSeek installers are infecting your device with dangerous malware
Trojan
Hackers hide malware into website images to go unnoticed
Pirate skull cyber attack digital technology flag cyber on on computer CPU in background. Darknet and cybercrime banner cyberattack and espionage concept illustration.
Criminals are using a virtual hard disk image file to host and distribute dangerous malware
Pirate skull cyber attack digital technology flag cyber on on computer CPU in background. Darknet and cybercrime banner cyberattack and espionage concept illustration.
Microsoft reveals over a million PCs hit by malvertising campaign
botnet
YouTubers targeted by blackmail campaign to promote malware on their channels
Latest in Security
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
Google Chrome
Google Chrome security flaw could have let hackers spy on all your online habits
cybersecurity
Chinese government hackers allegedly spent years undetected in foreign phone networks
Data leak
A major Keenetic router data leak could put a million households at risk
Latest in News
Xbox Series X and Xbox wireless controller set to a green background
Xbox Insiders are currently testing a new Game Hub feature that looks useful, but I've got mixed feelings about it
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
Microsoft Surface Laptop and Surface Pro devices on a table.
Hate Windows 11’s search? Microsoft is fixing it with AI, and that almost makes me want to buy a Copilot+ PC
Oura Ring 4
Activity tracking on Oura Ring is about to get a whole lot better, but I've got bad news about your step count
Google Pixel Buds Pro 2
Cleaned your Pixel Buds Pro 2 recently? If not, you might be getting worse sound
Google Maps on a phone being held in someone's hand
Google Maps is getting two key upgrades, for easier route planning and quicker access to Gemini AI