Home › Culture › Tech

Malware ‘Gayfemboy’ is Queer-Baiting at its Worst

Despite its cheeky name, the Mirai-inspired malware has been hijacking routers worldwide, capable of crashing websites and mining crypto for its operators

By Pie Gonzaga September 02, 2025

gayfemboy malware — Gayfemboy can very easily avoid detection, restarting itself if shut down and waiting up to 27 hours before activating to dodge detection. Photo by Joan Gamell/Unsplash

It’s not funny. A new malware named “Gayfemboy” has turned out to be one of 2025’s nastier cybersecurity threats. First detected in February 2024, it has been spotted spreading in the U.S., Mexico, Brazil, France, Germany, Switzerland, and Vietnam, Them reports. After a slew of cyberattacks in January this year, Gayfemboy attacked again in July.

According to cybersecurity company Fortinet, the malware targets a broad range of industries, including manufacturing, technology, and media. It infects everyday routers and networking gear from providers like Cisco and TP-Link by exploiting software flaws.

At this point, depending on your tastes and preferences, you might be thinking of letting Gayfemboy in.

But once inside, Gayfemboy adds connected devices to a botnet, or a digital network of hacked devices that attackers can control remotely as one massive system. From there, it can unleash distributed denial-of-service (DDoS) attacks, which bombard websites or servers with such a high volume of traffic that they become inaccessible. In some cases, it also installs cryptocurrency-mining software, quietly draining resources to generate digital coins for its operators.

gayfemboy malware meowmeow string backdoor — The malware can activate its backdoor functionality, bypassing normal authentication or encryption, through the string “meowmeow.” Photo from Fortinet/Official Website

Gayfemboy is also quite slippery. According to Them, it can rename files and restart itself if shut down. Fortinet also states that the malware can wait up to 27 hours before activating to evade detection, and even wipe out competing malware to maintain exclusive control of a device. It also communicates with its operators through domains with names like “i-kiss-boys,” “furry-femboys,” and “twinkfinder.”

For now, Fortinet and other cybersecurity services are leading the response by blocking domains, issuing patches, and urging organizations to secure their networks.

Fortinet stated that Gayfemboy is similar to a known malware called Mirai, which was first discovered attacking Minecraft servers in 2016. But the new malware is more complex, which only “reflects the increasing sophistication of modern malware.”

As of writing, there are no reports of the malware in the Philippines, but it doesn’t mean we shouldn’t update our antivirus software.

Pie Gonzaga

Culture Writer

Pie Gonzaga is the Culture Writer of Rolling Stone Philippines, primarily covering film, TV, food, and internet culture.

Gonzaga has worked on a range of stories for print and digital formats, from an interview with Cardinal Ambo David to features on queer party organizers such as CHURCH and Club Euphoria. Her work as the magazine’s former State of Affairs Writer includes news updates on pressing issues like the flood control scandal and the missing sabungeros, and covering rallies. Under Culture, she’s written episode recaps for hit shows, film reviews, and features on restaurants and the people who run them.

Before working with Rolling Stone Philippines, she contributed lifestyle and entertainment stories for a digital news platform.

See more stories by Pie Gonzaga