Threat actors capitalize on the high search volume for free versions of popular software.
If your blog post is for a technical audience, you should reference specific IoCs typically found in reports like those on ORKL : choziosi[.]xyz File: The.Jackbox.Party.Pack.7.zip ...
The loader is a multi-stage downloader that often follows this pattern: Threat actors capitalize on the high search volume