Loading story…
Researchers linked the operators behind OpenSUpdater to two code-signing abuse techniques designed to keep suspicious Windows executables looking trustworthy. In one campaign, the actor impersonated software company executives, registered lookalike domains, and passed certificate authority business validation to obtain legitimate code-signing certificates. ReversingLabs said those certificates were later used to sign OpenSUpdater samples, with evidence of certificate-authority hopping, repeated impersonation across multiple companies, and in some cases successful acquisition of extended validation certificates that can help bypass Microsoft SmartScreen warnings.
Google’s Threat Analysis Group later reported that OpenSUpdater samples also began carrying deliberately malformed code signatures that appeared valid to Windows while breaking parsing in some security tools. The manipulation altered the leaf X.509 certificate by replacing the expected NULL tag in the SignatureAlgorithm parameters field with an End of Content marker, causing stricter parsers such as OpenSSL-based implementations to reject the signature as invalid even as Windows and more permissive parsers could still accept it. Google said the financially motivated actor appeared focused on broad distribution, particularly targeting users seeking game cracks and other gray-market software, and described the technique as a novel way to preserve an apparently valid PE-file signature while evading detection.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
Since mid-August 2021, OpenSUpdater samples were observed carrying deliberately malformed code signatures designed to evade security products while still appearing valid to Windows. The manipulation replaced the NULL tag in the leaf certificate's SignatureAlgorithm parameters with an End of Content marker.
The last malicious file signed with the certificate in this observed campaign was spotted on May 16, 2019. Across the activity window, the certificate was used to sign 22 executables, with malicious samples belonging to the OpenSUpdater family.
The first malicious file signed with the fraudulently obtained certificate was observed in the wild. ReversingLabs identified it as OpenSUpdater, an adware family used to install unwanted software.
The actor used the obtained code-signing certificate to sign benign test files, including Notepad.exe and an NSIS installer, and uploaded them to a public antivirus scanning service. These files were used to validate the certificate and timestamping workflow before malicious use.
A financially motivated actor registered a lookalike .co.uk domain to impersonate a UK software company and support a fraudulent code-signing certificate application. The domain was used to mislead the certificate authority while redirecting web traffic to the legitimate .com site.
Google's Threat Analysis Group reported the malformed-but-apparently-valid signature issue affecting OpenSUpdater samples to Microsoft. TAG described it as the first time it had observed this technique used to preserve a valid PE-file signature while evading detection.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 22 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked multiple fake PDF and document-converter utilities to a broader malware delivery ecosystem that abuses trusted software components, valid code-signing certificates, and Electron or Nativefier-based installers to evade detection. Analyses of **TamperedChef**, **Aura Document Studio**, **Omni Transform**, **Doc Convert Wizard**, **OpenMyManual**, and **ManualReaderPro** describe staged installation chains in which browser-downloaded executables launch temporary installers, deploy rebranded applications, and contact shared infrastructure including `softwareinstallercdn[.]com`, `tool[.]securedocumentinstaller[.]com`, and `docu-flex[.]com`. Several samples reused identical payloads across different publisher names, while others were signed with valid EV certificates, reinforcing the appearance of legitimacy. The reported payloads include clipboard hijacking, host fingerprinting, persistence, and a JavaScript backdoor embedded in `helper.js` that retrieves the Windows `MachineGuid`, communicates over encrypted HTTPS with hardcoded command-and-control domains, and executes server-supplied code via `eval()`. The installers also showed signs of stealth and anti-analysis, including long dormancy periods, WebView2Loader abuse, Chromium-style child processes, plausible DLL names used as camouflage, and suspected DLL sideloading involving files such as `libEGL.dat` and `d3dcompiler_47.dll`. The campaign echoes older trust-based intrusion techniques documented in malware that hid behind signed Avast and Oracle executables through DLL search-order hijacking, underscoring how attackers continue to weaponize legitimate binaries and software trust to deliver credential theft and follow-on malware.
Jun 29, 2026
Expel reported that the malware operation it tracks as **BaoLoader** abused at least 26 code-signing certificates over roughly seven years to make malicious software appear legitimate, tying **AppSuite-PDF**, **PDF Editor**, **ManualFinder**, **PDFTools**, **PDFProSuite**, **OneStart**, and related installers to the same actor cluster. The activity was linked to repeated business registrations and certificate purchases from multiple certificate authorities, with a notable concentration of entities in **Panama** and **Malaysia**, allowing the operators to continue signing new payloads after earlier certificates were revoked. The reporting indicates BaoLoader has often been misclassified as a potentially unwanted program and at times confused with **ChromeLoader** and **TamperedChef**, but certificate patterns, installer behavior, and campaign history point to a distinct malware ecosystem. Additional analysis of **AppSuite PDF Editor** and **OneStart** supports the broader picture of deceptive software installers and backdoor-capable delivery chains, while Expel said code-signing irregularities and certificate reuse remain key hunting signals for defenders tracking the operation.
Aug 14, 2026
Threat actors are abusing **software-brand impersonation** to trick users into installing malware from fake distribution points, relying on social engineering rather than software exploits. Datadog reported an active campaign using **fake GitHub repositories** that impersonate established technology companies and leverage the **ClickFix** technique—prompting victims to copy/paste commands into *Terminal* (macOS) or *PowerShell/Run* (Windows)—to install infostealers. Datadog observed iterative updates to the *MacSync* lure and a new macOS infostealer variant self-branded as **“SHub Stealer v2.0”**, with expanded capabilities including **persistence** and **remote access**, alongside anti-analysis/evasion features intended to hinder detection and track infection outcomes; Datadog also assessed signs the actor is expanding toward **Windows infostealer** functionality. Separately, Malwarebytes documented a lookalike **7-Zip** download site (`7zip[.]com`, impersonating the legitimate `7-zip.org`) distributing a **trojanized installer** that installs a working 7-Zip File Manager while silently converting infected Windows systems into **residential proxy nodes**. The installer was **Authenticode-signed** with a certificate issued to **Jozeal Network Technology Co., Limited** (now revoked), and it dropped additional components—`Uphero.exe` (service manager/update loader), `hero.exe` (Go-compiled proxy payload), and `hero.dll`—under `C:\Windows\SysWOW64\hero\`; one reported case surfaced via Microsoft Defender detection `Trojan:Win32/Malgent!MSR` after the system had been exposed for an extended period. Together, the reporting highlights a sustained risk from **trusted-brand impersonation** and “looks legitimate” installers/repositories that deliver credential theft or monetize endpoints via proxyware.
Jul 2, 2026