A popular malware scheme and pay-per-install services. [Research Saturday]

Guest Michael DeBolt from Intel 471 joins Dave Bittner on this episode to discuss one of the most popular commodity malware loaders on the underground – PrivateLoader. The blog provides an analysis of campaigns since May 2021, full details on a Pay-per-install (PPI) malware service, the methods operators employ to obtain “installs,” and insights on the malware families the service delivers.
On Intel 471's blog, it shows the breakdown of how the PrivateLoader download is delivered and how it works. …

analysis blog campaigns commodity malware dave discuss install intel intel 471 loaders malware may michael michael debolt pay popular ppi privateloader research service services underground