New Argamal malware disguised as adult games targets users

A new malware campaign, identified as Argamal, is targeting individuals downloading adult video games. Detected in April 2026 by Kaspersky, this remote access trojan (RAT) is hidden within installers of hentai games, allowing attackers to gain remote control over infected computers, according to a recent report by HackRead.

The Argamal malware is distributed through adult game websites, file-sharing platforms, and torrent trackers. Infected installers contain fully functional games, making them appear legitimate. Upon launching, the malware executes a PowerShell script that checks for security tools before establishing a connection to attacker-controlled servers. After a three-day delay, it downloads and decrypts its main module using AES-CBC encryption. Argamal ensures persistence by hijacking Windows Color System Calibration Loader, allowing it to run every time a user logs in. Once active, it can steal files, access private chats, gather financial data, take screenshots, alter crypto-wallet addresses, and stream live video.

Kaspersky has identified hundreds of infections, primarily in Russia, Brazil, Germany, and Vietnam, with indications that the attackers speak Spanish. Notably, the malware avoids targeting users in China.

Source: HackRead