An insidious malware campaign targeting users searching for Google applications has infected thousands of computers globally to mine privacy-focused crypto monero (XMR).

You’ve probably never heard of Nitrokod. Israeli-based cyber intelligence firm Check Point Research (CPR) stumbled upon the malware last month. 

In a report on Sunday, the firm said Nitrokod initially masks itself as a free software, having found remarkable success at the top of Google search results for “Google Translate desktop download.”

Also known as cryptojacking, mining malware has been used to infiltrate unsuspecting user’s machines since at least 2017, when they rose to prominence alongside crypto’s popularity.

CPR previously detected well-known cryptojacking malware CoinHive, which also mined XMR, in November of that year. CoinHive was said to be stealing 65% of an end-user’s total CPU resources without their knowledge. Academics calculated the malware was generating $250,000 per month at its peak, with the bulk of it going to less than a dozen individuals.

As for Nitrokod, CPR believes it was deployed by a Turkish-speaking entity sometime in 2019. It operates across seven stages as it moves along its path to avoid detection from typical antivirus programs and system defenses. 

“The malware is easily dropped from software found on top Google search results for legitimate applications,” the firm wrote in its report.

Softpedia and Uptodown were found to be two major sources of fake applications. Blockworks has reached out to Google to learn more about how it filters these kinds of threats.

After downloading the application, an installer executes a delayed dropper and continuously updates itself on every restart. On the fifth day, the delayed dropper extracts an encrypted file. 

The file then initiates Nitrokod’s final stages, which sets about scheduling tasks,…