The easiest way to avoid this is sticking to known sources such as the MSI website (or known websites authorized to redistribute Afterburner.

Apparently the attacker repackaged Afterburner into a custom installer that, in addition to installing Afterburner, fetches XMR miner from the Internet and infects Windows Explorer (explorer.exe) with a cryptojacking payload. Apparently it uses Monero XMR miner software to mine cryptocurrency. Cyble deconstructed the malware-laced Afterburner installer in a bid to identify its nature. This malware can infect your PC with a multitude of bad stuff, including cryptojacking (using your PC's system resources to mine cryptocurrency for the attacker) and data-theft. are visual clones), and host redistributables of Afterburner, only these have a more sinister motive-to infect you with malware.Ĭybersecurity researchers at Cyble identified such spoof websites that are visually identical to the MSI website which host modified versions of the Afterburner software laced with malware. While some of these sites are just in it for some web-traffic ad revenue, others downright spoof the MSI website (i.e.

There are some dubious websites that are using SEO techniques and ad-placements to find their way into online search results, appearing to be download mirrors for MSI Afterburner. There are several other sites that redistribute the utility, many of them are trustworthy PC enthusiast tech publications but some of them are not. MSI Afterburner is arguably the most popular graphics card overclocking utility, and the best place to find it is the MSI website.

Msi afterburner download official site