Because GreenLuma is piracy-adjacent software, it is distributed via torrent sites, file-sharing forums (CS.RIN.RU), and sketchy YouTube descriptions. These vectors are prime real estate for cryptominers, RATs (Remote Access Trojans), and info-stealers.