Loading story…
Check Point Research reported that Electron Bot infected more than 5,000 Windows systems after being distributed through malicious applications in the official Microsoft Store, where it was disguised as popular games including Temple Run and Subway Surfer. The malware was delivered through Electron-based droppers that retrieved JavaScript payloads from attacker-controlled infrastructure, then established persistence through the Windows Startup folder and maintained command-and-control communications for ongoing tasking.
Researchers said the modular bot was used for ad click fraud, SEO poisoning, and social media manipulation affecting platforms such as Facebook, Google, YouTube, and SoundCloud. The campaign appears to have evolved from an ad-clicking operation first observed in 2018, with infections concentrated in countries including Sweden, Bulgaria, Russia, Bermuda, and Spain; researchers warned that the malware’s flexible architecture could also support more dangerous follow-on payloads such as ransomware or remote access trojans.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Check Point Research said the Microsoft Store game "Temple Endless Runner 2," used to demonstrate the campaign, was published on September 6, 2021. The app was one of the malicious game-themed lures used to distribute Electron Bot through Microsoft's official store.
Check Point Research said the attackers' activity began as an ad-clicker campaign that was discovered at the end of 2018. This earlier activity was identified as the starting point of the campaign that later evolved into Electron Bot.
Check Point Research publicly described the Electron Bot malware campaign and its distribution via malicious applications in Microsoft's official Store. The report detailed the malware's modular architecture, infection chain, persistence, and command-and-control behavior.
By the time of the report, Electron Bot had infected more than 5,000 active machines worldwide through malicious Microsoft Store applications disguised as popular games. The malware supported click fraud, SEO poisoning, and social media manipulation across multiple platforms.
An earlier variant of the malware was hidden in the Microsoft Store as an application named "Album by Google Photos" that claimed to be published by Google LLC. The report presents this as a precursor to the later game-themed Electron Bot distribution.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed multiple malware operations that silently modify major web browsers to inject unauthorized ads and generate affiliate revenue. Microsoft said the **Adrozek** campaign affected Microsoft Edge, Google Chrome, Yandex Browser, and Mozilla Firefox, using large volumes of polymorphic samples from 159 distribution domains to alter browser components, disable security checks, tamper with updates, and persist through registry changes and services. The activity peaked at more than 30,000 impacted devices per day and was concentrated across Europe, South Asia, and Southeast Asia; on Firefox, the malware also decrypted and stole stored credentials for exfiltration. Walmart Global Tech separately reported that the **Pbot** adware framework evolved from earlier activity into a more complex, staged infection chain delivered through NSIS installers and bundled components including a Chrome extension named `Kodobi`. The updated malware used obfuscated Python scripts, persistence mechanisms, DNS TXT records carrying base64-encoded URLs, and JavaScript-based payload delivery to fetch configuration files, inject ads, and perform fake clicks for advertising fraud. The report linked parts of the infrastructure and build artifacts to an affiliate-style monetization ecosystem associated with AdvPartners-related URLs, underscoring how browser-focused ad fraud malware has grown more persistent, modular, and financially motivated.
Aug 15, 2026
Researchers reported an ongoing campaign of trojanized Microsoft Store utility apps that masqueraded as legitimate software such as **WinDirStat** and **LightShot** while covertly loading a Go-based backconnect/proxy payload. The Electron-based packages used Node.js foreign-function interfaces to load malicious DLLs, initially via `koffi` and later via `ffi-rs`, with observed filenames including `client.dll`, `telemetry.dll`, and patterned names such as `lib[A-Z0-9]{3}.dll`. Analysis of the payload found controller-driven HTTPS heartbeats, machine fingerprinting, and `yamux` multiplexing, indicating the apps were likely enrolling victim systems into a residential proxy or backconnect infrastructure. The operation appeared to evolve while retaining the same core behavior, with newly observed publisher identities including **TECHNOLOGIES FOR BUSINESS LLC** and **SOFTWARE MATTERS LLC** and command-and-control domains such as `gate1.storetelemetryapiapps.xyz`, `telemetrystoreapi1.xyz`, and `storetelemetryapi.xyz`. Investigators said the apps deceptively lured users with free software and did not clearly disclose that installed systems could be repurposed as proxy nodes, extending a broader campaign that researchers traced back to related activity seen before its Microsoft Store distribution.
Jul 7, 2026
Multiple malware campaigns have recently targeted Windows users through a variety of social engineering tactics and deceptive file distribution methods. In Korea, attackers leveraged popular webhard file-sharing services to distribute the xRAT (QuasarRAT) remote access trojan disguised as adult games. Victims were enticed to download compressed files that appeared to be legitimate games, but actually contained sophisticated malware components designed to evade detection and establish persistence on compromised systems. Meanwhile, a separate campaign in Brazil saw the Astaroth banking trojan propagate via WhatsApp, where a worm-like component harvested contact lists and automatically sent malicious ZIP files to spread the infection further. This campaign combined Python-based propagation with traditional credential-stealing modules focused on financial fraud. Other notable campaigns included the use of fake WinRAR installers distributed through Chinese websites, which employed multi-stage payloads to select and deploy the most effective malware for each victim. Additionally, phishing attacks impersonating DocuSign lured users into downloading stealthy malware through access code-protected web pages, using obfuscated PowerShell commands and in-memory payload decryption to bypass security controls. These incidents highlight the increasing sophistication of malware delivery mechanisms, the use of trusted brands and platforms for social engineering, and the global reach of threat actors targeting Windows environments through both email and messaging applications.
Jun 29, 2026