Key Findings: A once legitimate video download software site, OSDSoft, has moved into crypto-mining. Around 6000 machines have been infected in just a few months. Distributed by a fraudulent Adobe Flash Player update service, the malware is mining $700 of Monero crypto currency for the perpetrator each day. Check Point researchers have recently discovered a site that although once (almost) legitimate has now moved closer to the Dark Side. Back in 2011, OSDSoft was a site offering its audience free video download software to thousands of users around the world. Registered under the name of Ivan Koslov, it also had Facebook, Twitter and YouTube accounts marketing the website’s main and only product. It was to all intents and purposes a legitimate site. Moving to the Dark Side In 2014 however, OSDSoft started to appear in more suspicious contexts as several Adwares and Potentially Unwanted Programs (PUPs) downloaded from it were spotted in the wild. These ...