Loading story…
Researchers reported an ongoing campaign of trojanized Microsoft Store utility apps that masqueraded as legitimate software such as WinDirStat and LightShot while covertly loading a Go-based backconnect/proxy payload. The Electron-based packages used Node.js foreign-function interfaces to load malicious DLLs, initially via koffi and later via ffi-rs, with observed filenames including client.dll, telemetry.dll, and patterned names such as lib[A-Z0-9]{3}.dll. Analysis of the payload found controller-driven HTTPS heartbeats, machine fingerprinting, and yamux multiplexing, indicating the apps were likely enrolling victim systems into a residential proxy or backconnect infrastructure.
The operation appeared to evolve while retaining the same core behavior, with newly observed publisher identities including TECHNOLOGIES FOR BUSINESS LLC and SOFTWARE MATTERS LLC and command-and-control domains such as gate1.storetelemetryapiapps.xyz, telemetrystoreapi1.xyz, and storetelemetryapi.xyz. Investigators said the apps deceptively lured users with free software and did not clearly disclose that installed systems could be repurposed as proxy nodes, extending a broader campaign that researchers traced back to related activity seen before its Microsoft Store distribution.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
WatchGuard Threat Lab reported a TimbreStealer campaign targeting companies in Mexico with tax- and invoice-themed phishing emails delivering ZIP archives. The archives used legitimate-looking updater executables alongside oversized malicious DLLs such as msedgeupdate.dll and goopdate.dll to enable DLL side-loading and steal browser, email, and cloud-storage data.
An update on the same Microsoft Store app campaign reported new publisher names, DLL naming patterns, and a technical shift from koffi to ffi-rs to load the Go-based proxyware binary. Newly observed infrastructure included publishers TECHNOLOGIES FOR BUSINESS LLC and SOFTWARE MATTERS LLC and command-and-control domains such as gate1.storetelemetryapiapps.xyz, telemetrystoreapi1.xyz, and storetelemetryapi.xyz.
Research documented fake Microsoft Store utility apps, especially a WinDirStat impersonator, that used Electron and the Node.js koffi library to load a malicious Go-based DLL named client.dll with backconnect/proxy functionality. Related samples indicated reuse across multiple fake utility-themed packages, including LightShot impersonators, likely enrolling victim systems into proxy infrastructure.
The broader campaign tied to trojanized utility-themed apps and Go-based backconnect/proxy payloads had related activity visible as early as October 2025, predating the later Microsoft Store distribution.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 33 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
trojan-killer.net
Open sourceblog.lukeacha.com
Open sourceblog.lukeacha.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers have set up more than 70 lookalike websites impersonating popular Windows utility and customization apps, including **Wintoys**, **PowerToys**, **WinUtil**, **EasyBCD**, **CrystalDiskMark**, **Lively Wallpaper**, and **SignalRGB**, to lure users searching for downloads. The campaign was uncovered after Wintoys developer **Bogdan Pătrăucean** identified a cloned site for his app and traced it to a wider domain cluster linked by the anonymized WHOIS contact `43345@anonymize.com`, with operators reportedly shifting domains to a new registrar after scrutiny. Researchers said the sites use a staged approach: some initially serve legitimate installers to build trust, then later replace them with malicious downloads. Observed payloads include trojanized installers, persistent **ScreenConnect** remote-access software, **RemusStealer**, **AnimateClipper**, and bandwidth-sharing software, while proxy-backed hosting has helped keep parts of the infrastructure online. Some domains have been flagged by **Cloudflare** or added to **Hagezi** blocklists, but many remain active, increasing the risk for users who download Windows apps from search results instead of official developer pages or the Microsoft Store.
Jul 27, 2026
Multiple Windows-focused malware campaigns were reported leveraging *trusted distribution and execution paths* rather than exploiting software vulnerabilities. One campaign attributed to **Larva-25012** disguised proxyware as legitimate *Notepad++* installers distributed via fake cracked-software portals and deceptive ads, primarily impacting South Korea. The payloads were hosted on GitHub and delivered as MSI/ZIP packages containing legitimate components plus malicious DLLs, using **DLL side-loading** and process injection into **Windows Explorer** to deploy proxyware (e.g., **Infatica** and **DigitalPulse**) for **proxyjacking**—monetizing victims’ internet bandwidth by reselling access through their networks. A separate multi-stage Windows malware operation used business-themed lures and weaponized archives containing **LNK** shortcuts to run hidden **PowerShell** with execution-policy bypass, pulling an obfuscated loader from GitHub and using legitimate services (e.g., **Dropbox**) to blend into normal traffic. Fortinet-reported tradecraft included persistence, decoy document generation, and beaconing via the **Telegram Bot API**, followed by defense evasion through abuse of **Defendnot** to disable Microsoft Defender before dropping follow-on payloads such as ransomware, banking trojans, and surveillance tooling. Additional reporting highlighted a broader trend of attackers abusing legitimate infrastructure and admin tooling (including **RMM** software after credential theft) to establish persistent access, while generic “common threats” content provided no incident-specific intelligence.
Jun 29, 2026
Threat actors are abusing **software-brand impersonation** to trick users into installing malware from fake distribution points, relying on social engineering rather than software exploits. Datadog reported an active campaign using **fake GitHub repositories** that impersonate established technology companies and leverage the **ClickFix** technique—prompting victims to copy/paste commands into *Terminal* (macOS) or *PowerShell/Run* (Windows)—to install infostealers. Datadog observed iterative updates to the *MacSync* lure and a new macOS infostealer variant self-branded as **“SHub Stealer v2.0”**, with expanded capabilities including **persistence** and **remote access**, alongside anti-analysis/evasion features intended to hinder detection and track infection outcomes; Datadog also assessed signs the actor is expanding toward **Windows infostealer** functionality. Separately, Malwarebytes documented a lookalike **7-Zip** download site (`7zip[.]com`, impersonating the legitimate `7-zip.org`) distributing a **trojanized installer** that installs a working 7-Zip File Manager while silently converting infected Windows systems into **residential proxy nodes**. The installer was **Authenticode-signed** with a certificate issued to **Jozeal Network Technology Co., Limited** (now revoked), and it dropped additional components—`Uphero.exe` (service manager/update loader), `hero.exe` (Go-compiled proxy payload), and `hero.dll`—under `C:\Windows\SysWOW64\hero\`; one reported case surfaced via Microsoft Defender detection `Trojan:Win32/Malgent!MSR` after the system had been exposed for an extended period. Together, the reporting highlights a sustained risk from **trusted-brand impersonation** and “looks legitimate” installers/repositories that deliver credential theft or monetize endpoints via proxyware.
Jul 2, 2026