Cryptojacking - Spoofed App Dropping Autorun.dll (T1574.002)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•6

Detects a spoofed utility executable (like CrystalDiskInfo via MSI) loading the malicious autorun.dll from the downloads path, indicative of a cryptojacking campaign.