Executive Summary
Discovered in April 2026, the Argamal campaign targets users through infected adult games distributed on torrent sites and file-sharing platforms like PixelDrain. Attackers use a multi-stage infection chain starting with a modified FFmpeg library that executes a malicious script. This script facilitates persistent system access and eventual full control over the victim's machine.
The technical workflow involves PowerShell stagers, DLL sideloading, and COM hijacking for persistence. The malware utilizes environment variables for execution and GitHub for hosting encrypted payloads. The final payload is a robust RAT capable of surveillance, file manipulation, and direct system command execution.
While the primary target appears to be individual gamers in Russia, Brazil, Germany, and Vietnam, the capability for full system compromise poses a significant risk for data and credential theft. Attribution points with medium confidence toward a Spanish-speaking developer based on code comments and variable naming conventions.