Reported by 2 outlets

Timeline

1. original reporting

   PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner

   gbhackers.com · 24d ago · September 19th, 2026

   A sophisticated cryptomining campaign is employing multiple layers of obfuscation to conceal malicious PowerShell payloads and ultimately deploy an XMRig-based cryptocurrency miner. This obfuscation includes Windows Registry entries, DNS TXT records, PNG images, and WAV audio files. The infection was detected after repeated security alerts indicated suspicious PowerShell activity. The initial execution command launched PowerShell […] The post PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   Hackers Hide PowerShell Malware in Registry, PNG and WAV Files to Deploy XMRig Miner

   cyberpress.org · 24d ago · September 19th, 2026

   Researchers have uncovered a multi-stage cryptomining campaign that uses PowerShell, Registry-stored payloads, DNS TXT records, PNG images, and WAV audio files to conceal malware and deploy an XMRig-based cryptocurrency miner on compromised Windows systems. Initial analysis showed that the malware launched PowerShell with -NoProfile and execution-policy bypass settings before retrieving a malicious script from the Windows Registry. PowerShell Malware in Registry The command accessed a value under HKLM:\Software\uf42a9660377\vstdfehzr , allowing the attacker to avoid placing the next-stage PowerShell payload directly on disk. The Registry value contained encoded binary data that was decoded dynamically at runtime. This Registry-resident stage then queried DNS TXT records associated with sslvalidcert[.]com , later switching to txtcdn[.]net . The malware converted decimal values from the TXT response into ASCII characters, ultimately reconstructing a URL for a PNG image hosted at frames-1zm[.]pages[.]dev . Attack Chain (Source: K7 Security Labs) Rather than using the image as normal visual content, the attackers embedded code in the PNG’s pixel data. The PowerShell loader extracted information from the image’s red colour channel, reconstructed the hidden script, and executed it. According to K7 Security Labs, this payload subsequently established command-and-control communication a