German Romance Scam Malware Lures Victims with Flirty Emails

Cybercriminals are targeting German speakers with seductive emails that promise adult content—but instead deliver malware. The German romance scam malware campaign uses flirtatious messages and fake videos to lure victims into downloading malicious files from a Russia-based server.

“Hello, Stranger…” — The Bait

The scam begins with an email that reads like the start of an online affair. One example:

“Hello, stranger. I’m not the one who gives herself completely right away. But sometimes, there’s the desire to be intensely felt.”

It ends with a tempting line:

“I’ve prepared a little package just for you.”

That “package” turns out to be anything but romantic. The email contains two malicious links—one in the image preview and one pointing to a downloadable archive file.

Location-Based Malware Targeting

Once the user clicks a link, a traffic distribution system called Keitaro TDS checks whether they’re located in Germany. If confirmed, the system secretly downloads a 300MB ISO file from a Russia-based server.

This geo-targeting method helps attackers focus their scam efforts on users inside Germany, increasing their chances of success by customizing attacks by region.

Fake Video, Real Malware

Inside the downloaded ISO file is:

• An executable named “lovely_photos.exe”
• A text file labeled with the password “love”

Once the victim runs the program and enters the password, a hidden script launches AutoIt, which is used to:

• Bypass antivirus detection
• Create a scheduled task called DragonMapper
• Ensure the malware runs every time the system boots

Still Active, Still Dangerous

The campaign was revealed in a report by Sublime Security, but so far, no official count of victims or financial damages has been disclosed. The report also did not explain why German users were specifically targeted.

As of now, the German romance scam malware attack is still active, and authorities have not confirmed any takedowns.

Conclusion

The German romance scam malware campaign shows how emotional manipulation and targeted tactics can be used to bypass common defenses. With ISO files posing as love letters and scripts hiding behind seductive promises, this scam is a stark reminder: don’t click on love from strangers.