Hackers are using fake MP4 video files to smuggle payloads past security filters
From 333.mp4 to web02message.mp4 – attackers frequently rename their “content.”
Image by Cybernews.
- Attackers use fake MP4 files as containers to hide and deliver malware payloads.
- Censys found 18 malware builds across 40 active servers in six hosting networks.
- The campaign installs NetSupport Manager to give attackers remote control of infected systems.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Attackers are hiding payloads inside MP4 carrier files. It’s not a playable video, but a container that helps attackers smuggle hidden data past automated security checks.
Censys security researchers warn of a malicious campaign that leverages fake MP4 video files to deliver larger payloads after the initial compromise.
Attackers created 18 separate malware builds and scattered them across 40 active servers spanning 6 hosting networks and 4 countries. The massive infrastructure was built on August 21st, 2026. Attackers hid at least part of their infrastructure behind Cloudflare’s proxy service.
The threat actor uses video files to package NetSupport Manager client software – a legitimate remote monitoring and management tool used by IT administrators to manage devices across the network. However, adversaries misuse the software to gain unauthorized persistence and secretly control their victim systems.
The initial compromise still relies on a user mistake, such as accidentally “solving” a fake CAPTCHA that tricks them into running a malicious script, known as the ClickFix attack.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
Many phishing campaigns recently focused on victims infecting themselves by opening a Windows Run dialog and pasting a command.
The first-stage dropper first checks the computer name for sandbox patterns, hides the PowerShell console window, and then contacts a remote URL to download additional binary data. The script contains code that allows for decrypting and decompressing the payload.
The malware puts a secondary script into the temporary folder (%TEMP%) and then retrieves the MP4 file from the attacker’s server, mimicking the Chrome user agent.
The request looks like a standard media traffic. But the MP4 video is only 6.5MB. It has zero dimensions and lacks decoding parameters: most of it, 99.95%, is a hidden container called a UUID box – a marker telling the malware where the hidden payload is inside the fake file.
“It is a convincing shell designed solely to pass automated file-type inspections while masking the transport of a large script,” Censys researchers said in a report.
The malware operator frequently rotates video files without maintaining backward compatibility, breaking older deployments.
The threat actor uses Russian-language business sites as facades for command-and-control and delivery servers. Censys noted that 2 gateway domains were registered just 77 seconds apart.
The report doesn’t specify the end goal of the attackers. However, the covert deployment of NetSupport Manager gives them full visibility and control over the infected system. This access is typically used for credential theft, further malware installation, crypto mining, spying, lateral movement, or resale to other threat actors.
Simply playing the MP4 file used by the attackers wouldn’t infect any computer. However, that doesn’t mean it’s entirely impossible.
Cybernews has previously detailed a vulnerability in a video codec decoder that could be abused to crash systems or even run arbitrary code from a video file.