Threat actors are abusing the QEMU open-source emulator to deploy hidden virtual machines, enabling persistent access, credential harvesting, and the deployment of PayoutsKing ransomware. This technique, attributed to the GOLD ENCOUNTER group, leverages compromised credentials from CitrixBleed to establish initial access. The article does not describe a vulnerability in QEMU itself but rather its malicious use as an attack tool, so no CVSS score, affected versions, patches, or specific workarounds are provided.