Loading story…
Expel reported that the malware operation it tracks as BaoLoader abused at least 26 code-signing certificates over roughly seven years to make malicious software appear legitimate, tying AppSuite-PDF, PDF Editor, ManualFinder, PDFTools, PDFProSuite, OneStart, and related installers to the same actor cluster. The activity was linked to repeated business registrations and certificate purchases from multiple certificate authorities, with a notable concentration of entities in Panama and Malaysia, allowing the operators to continue signing new payloads after earlier certificates were revoked.
The reporting indicates BaoLoader has often been misclassified as a potentially unwanted program and at times confused with ChromeLoader and TamperedChef, but certificate patterns, installer behavior, and campaign history point to a distinct malware ecosystem. Additional analysis of AppSuite PDF Editor and OneStart supports the broader picture of deceptive software installers and backdoor-capable delivery chains, while Expel said code-signing irregularities and certificate reuse remain key hunting signals for defenders tracking the operation.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
Expel, working with CertGraveyard.org, published an analysis concluding that BaoLoader developers abused at least 26 code-signing certificates over roughly seven years and often registered businesses directly to obtain them. The report also argued BaoLoader is distinct from ChromeLoader and TamperedChef based on certificate patterns, tactics, and campaign history.
Expel said the earliest certificate it linked to BaoLoader activity in CertGraveyard data dates to 2018, indicating the operation has been active since at least that year.
Expel assessed with high confidence that AppSuite-PDF, PDF Editor, ManualFinder, PDFTools, PDFProSuite, and OneStart were distributed by the same team it tracks as BaoLoader. It described AppSuite-PDF as an installer that downloads PDF Editor while also including a backdoor.
Expel said that after additional certificate revocations, the BaoLoader operators obtained new code-signing certificates for Onestart Technologies LLC from SSL.com and DigiCert.
After Apollo Technologies certificates were revoked, the actors used an SSL.com-issued certificate for Caerus Media LLC to sign OneStart-related files, according to Expel.
Expel reported that the developer signed OneStart with multiple Apollo Technologies Inc. code-signing certificates issued by SSL.com and GlobalSign. The report said OneStart was often downloaded unintentionally through PDF editor ads or bundled software.
Expel linked earlier BaoLoader activity to products including PDF Pro Suite, ManualsViewer, PDFFlex, and other PDF- or manual-themed applications. It also identified related certificate use for signer names such as Digital Promotions Sdn. Bhd. and Eclipse Media Inc. across these campaigns.
Expel found a DigiCert-issued Eclipse Media Inc. certificate on files uploaded under lure names such as ZoomSetup, TinyTaskSetup, WinRarSetup, and MinecraftSetup that installed Web Companion. The report also said BaoLoader-associated certificates were used to load Browser Assistant or Web Companion and that some Web Companion DLLs were re-signed by the actors.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 46 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Breakglass Intelligence identified several active malware delivery operations using signed installers, compromised websites, and live command-and-control infrastructure to distribute loaders, stealers, and remote access tools. One campaign used the newly registered domain `maybedontbanplease[.]com` as CastleLoader C2 on 3NT Solutions LLP infrastructure, with a large NSIS installer embedding Python 3.14, AES-encrypted payloads, and in-memory shellcode execution via `pythonw.exe`; the installer was signed with an EV certificate issued to the likely fictitious entity **SERPENTINE SOLAR LIMITED**. The activity was attributed with medium-high confidence to **GrayBravo** and linked to delivery of **LummaC2, StealC, RedLine, Rhadamanthys, DeerStealer, NetSupport RAT,** and **SectopRAT**, with targeting that included U.S. government, critical infrastructure, IT, and logistics organizations. A separate operation distributed a trojanized `MSTeamsSetup.exe` that installed a weaponized **RustDesk** client and communicated with `mon.systemautoupdater[.]com` on EvoXT infrastructure, while presenting a TLS certificate for `calipology[.]com`, tying the activity to the **GeorgeGinx/Striker** operator. In another live campaign, attackers used the compromised Syrian web development site `allsydevs[.]com` to host an obfuscated .NET loader masquerading as a WordPress image and connected victims to `172[.]93[.]167[.]12:4263` over HTTPS using a self-signed certificate with the fake common name **Mesh Data**; at least six related samples were linked to the same C2, with lure names suggesting targeting of Middle Eastern construction and export firms. Together, the investigations show financially motivated actors expanding malware distribution through fraudulent code-signing, trojanized business software, and hijacked web infrastructure.
Jun 29, 2026
Researchers linked **PrivateLoader** to a long-running pay-per-install malware ecosystem that used SEO-poisoned sites and cracked-software lures to infect Windows users with password-protected ZIP archives and NSIS installers. The loader was repeatedly observed delivering a wide range of payloads, including **RedLine**, **Vidar**, **SmokeLoader**, **RisePro**, **Qbot**, **Dridex**, **DanaBot**, **TrickBot**, **Kronos**, **LockBit**, **STOP Djvu**, and **Conti**, while related tooling such as **Discoloader** and the Go-based **Anubis Loader** expanded the same distribution chain. Investigations described administration panels used to manage payload links, browser extensions, bot installs, and operator activity, with one panel reportedly overseeing about **20,000 bots** and collecting more than **11 GB** of stealer logs in less than two weeks. Separate reporting showed PrivateLoader also acting as an access broker for other criminal and state-linked operations. Analysts observed it distributing **ColibriLoader** in a campaign tied to **UAC-0113**, a group CERT-UA has associated with **Sandworm**, and later delivering **Socks5Systemz**, a proxy botnet that converted infected Windows hosts into rentable proxies. Bitsight estimated Socks5Systemz had about **10,000 infected systems** and at least **53 servers** supporting command-and-control, telemetry, DNS, and backconnect functions, with customers buying proxy access through a Telegram-linked service for cryptocurrency. Across the reporting, PrivateLoader emerged as a versatile initial-access platform connecting commodity stealers, banking trojans, ransomware, proxy monetization, and higher-end intrusion activity.
Aug 15, 2026
Researchers reported that the **TamperedChef** malware operation, also tracked as **EvilAI**, has distributed trojanized productivity software through malvertising and polished download sites, posing as tools including **Calendaromatic**, **DocuFlex**, **AppSuite PDF**, **OneZip**, **CrystalPDF**, **PDF-Ezy**, and **RapiDoc**. The campaign has been active since early 2023 and uses valid code-signing certificates, delayed second-stage delivery, persistence mechanisms, and stealthy execution to evade detection while deploying adware, browser hijackers, information stealers, RATs, and proxy-style payloads. Unit 42 said it identified more than **4,000 unique samples** and **100+ variants**, with infections observed in more than half of monitored enterprise environments. Analysis of the **rapidoc** subcluster linked the activity to broader fake-app campaigns and highlighted code reuse, certificate rotation, and infrastructure overlap with related **BaoLoader** activity. Researchers described two main branches: a **Calendaromatic** `7zSFX` dropper line tied to shell companies including **CROWN SKY LLC** and **MARKET FUSION INNOVATIONS LLC**, and a **Neutralinojs**-based **RapiDoc** stage-0 line tied to **CANDY TECH LTD**. A recurring tracking artifact was the **GlobalSign GCC R45 EV CodeSigning CA 2020** sub-CA certificate with serial `77BD0E05B7590BB61D4761531E3F75ED`, which was used to connect shell-company activity across Israel, Ukraine, Panama, Malaysia, Estonia, and the United States; researchers also found an unsigned sibling sample communicating with `calendaromatic.com`, suggesting some operators may be dropping code signing to reduce attribution risk.
Jun 29, 2026