Israeli cyber-intelligence firm Check Point Research (CPR) has discovered Nitrokod, a malware that infects computers to mine Monero (XMR), disguising itself as Google Translate Desktop Download at the top of Google search results. desktop download) or other legitimate popular applications. After the app is downloaded, the installer executes a delayed release procedure and keeps updating on every reboot, then schedules tasks, clears logs, and adds exceptions to the antivirus firewall after 15 days, finally completes the infection and starts mining Monero with XMRig Mine, currently monitored to have infected thousands of computers around the world.