Pirated copies of Windows 10 are within reach of anyone who searches the Internet. And they are massively searched, downloaded and used. License key crackers are also available, while Microsoft closes the loop by not making too many complications (and not Windows 11, whose activation servers swallow everything that comes their way) if the user continues to use Windows and does not jump to other systems like Linux.

Cybercriminals are fully aware of the situation and are taking advantage of it. The latest alert comes from security firm Dr.Web after it found a series of pirated copies of Windows 10 distributed on the BitTorrent network that come with a “price”: Malware Clipper specialized in cryptocurrency hijacking it hides itself in the EFI partition to avoid detection.

You already know that EFI is a small partition that contains the bootloader and related files that run before the operating system starts. It is necessary for computers powered by UEFI, the new firmware that replaced outdated BIOSes.

There have already been reports of hackers using modified EFI partitions to activate various malware outside the context of the operating system and its defense tools, such as BlackLotus, the first UEFI malware capable of bypassing Windows Secure Boot.

However, in this case, pirated Windows 10 ISO images discovered by researchers at Dr they just use EFI as a safe storage space for Clippera well-known and dangerous malware aimed at stealing virtual currencies, leaving you “naked” if you use them, by being able to change the addresses of cryptographic wallets under the attacker’s control, and then redirect payments to their accounts.

Although this type of attack does not reach the level of the aforementioned BlackLotus, it is extremely effective because standard antivirus tools usually do not scan the EFI partition and malware can be missed.

Don’t play it! Every month we offer you different promotions to get Windows 10 licenses, original, safe and for life, starting from 12 euros.