Infatica

Infatica is a proxyware agent installed in ongoing “proxyjacking” campaigns attributed to the threat actor Larva-25012. In these operations, attackers disguise malware as legitimate software installers—especially trojanized Notepad++ packages distributed through fake cracked/pirated software download sites, deceptive ads, and GitHub-hosted payloads—then silently install Infatica to monetize victims’ internet bandwidth without consent. The broader infection chain uses DLL side-loading, staged loaders referred to as DPLoader, PowerShell-based installation steps, and persistence via Windows Task Scheduler. Reported variants install additional components such as NodeJS or Python, communicate with command-and-control servers for instructions, inject payloads into legitimate Windows processes including explorer.exe, and weaken host defenses by modifying Windows Defender settings such as exclusions, notifications, and sample submission behavior. Infatica has been observed installed alongside other proxyware such as DigitalPulse, and in some cases follows prior Honeygain or DigitalPulse deployments. For persistence and camouflage, Infatica-related activity has been tied to scheduled tasks including “UNBScheduler” and a masqueraded task named “Microsoft Anti-Malware Tool,” which runs “MicrosoftAntiMalwareTool.exe” to appear legitimate. The campaign primarily affected systems in South Korea and targeted users seeking free or pirated software.