Fake Adobe Audition Patch Fans Out Into Two Trojan Families
A cracked-software lure for Adobe Audition drops two forensically distinct payloads — trojan.swisyn/gosys and trojan.autoit/nymeria — from the same install path, pointing to a distribution package built to fan out rather than a single-purpose loader.
A pirated license patch for Adobe Audition is doing more work than a typical cracked-software lure. Once a victim runs the fake "Adobe Audition Patch v24.exe," the package drops from an identical temporary-folder fragment — u2pvkyr3.1xh\Patch-Activated\ — into two forensically distinct payloads that VirusTotal resolves under entirely different threat labels: trojan.swisyn/gosys on one branch, trojan.autoit/nymeria on the other.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read