Loading story…
Researchers reported that Projextor is masquerading as legitimate desktop tools, including document converters, meal planners, and recipe applications, to infect users through lookalike download sites and common installer frameworks. The campaign delivers a second-stage Electron application that continues to function as expected while concealing malicious behavior, allowing the malware to blend into normal user activity and evade suspicion.
According to reporting tied to the campaign, the malware abuses Electron by replacing or adding malicious main.js and preload.js files in the application resources directory, disabling context isolation, and enabling execution of additional JavaScript modules after installation. Indicator data linked to the activity includes domains such as doceditorinc[.]com, meal-formula[.]com, kitchen-canvas[.]com, flipformatpdf[.]com, and pdfgrip[.]com, as well as a staging path at conv.doceditorinc[.]com/latest/part; researchers also warned that Projextor includes screen-capture capability that could expose documents, browser sessions, email, and business application data visible on infected systems.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Published indicators tied the campaign to domains including doceditorinc[.]com, meal-formula[.]com, kitchen-canvas[.]com, flipformatpdf[.]com, and pdfgrip[.]com, as well as the path conv.doceditorinc[.]com/latest/part. The references also listed SHA-256 hashes for FlipFormat, PDFGrip, FoodFormula, KitchenCanvas, preload.js, and main.js samples.
Researchers found that Projextor included a custom screen-sharing picker that listed monitors and application windows with thumbnails. This capability could expose sensitive information visible during live user sessions, including documents, browser activity, email, and business applications.
G Data reported that Projextor installs malicious main.js and preload.js files in the Electron application resources directory, where they launch automatically at startup. In observed samples, main.js disabled Electron context isolation and allowed additional JavaScript modules to be loaded from an injection directory after installation.
Researchers at G Data identified Projextor as a malware campaign that hides malicious code inside legitimate-looking desktop utilities such as document converters, meal planners, and recipe applications. They found the campaign used lookalike download sites and common installer frameworks to deliver a second-stage Electron application that remained functional while concealing malicious behavior.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked multiple fake PDF and document-converter utilities to a broader malware delivery ecosystem that abuses trusted software components, valid code-signing certificates, and Electron or Nativefier-based installers to evade detection. Analyses of **TamperedChef**, **Aura Document Studio**, **Omni Transform**, **Doc Convert Wizard**, **OpenMyManual**, and **ManualReaderPro** describe staged installation chains in which browser-downloaded executables launch temporary installers, deploy rebranded applications, and contact shared infrastructure including `softwareinstallercdn[.]com`, `tool[.]securedocumentinstaller[.]com`, and `docu-flex[.]com`. Several samples reused identical payloads across different publisher names, while others were signed with valid EV certificates, reinforcing the appearance of legitimacy. The reported payloads include clipboard hijacking, host fingerprinting, persistence, and a JavaScript backdoor embedded in `helper.js` that retrieves the Windows `MachineGuid`, communicates over encrypted HTTPS with hardcoded command-and-control domains, and executes server-supplied code via `eval()`. The installers also showed signs of stealth and anti-analysis, including long dormancy periods, WebView2Loader abuse, Chromium-style child processes, plausible DLL names used as camouflage, and suspected DLL sideloading involving files such as `libEGL.dat` and `d3dcompiler_47.dll`. The campaign echoes older trust-based intrusion techniques documented in malware that hid behind signed Avast and Oracle executables through DLL search-order hijacking, underscoring how attackers continue to weaponize legitimate binaries and software trust to deliver credential theft and follow-on malware.
Jun 29, 2026
Security researchers reported multiple malware campaigns using trojanized utility software—including fake PDF converters, ZIP tools, and a malicious PDF editor—to infect users who arrive via search ads and download portals. Intezer identified two families, **SilentMare** and **HollowMare**, embedded in seemingly legitimate utilities: SilentMare acts as a downloader and foothold, using custom installers, scheduled-task persistence, daily updater check-ins, and AES-encrypted .NET payloads executed in memory, while HollowMare behaves more like a potentially unwanted application that installs browser extensions or hijacks default search settings. Truesec separately described a malicious **Appsuite PDF Editor** delivering **TamperedChef**, reinforcing the use of fake productivity tools as an infection vector. The reporting shows a broader resurgence of Trojan horse delivery through software impersonation, including lures tied to AI-themed branding and homoglyph abuse to make malicious sites and applications appear legitimate. Intezer said SilentMare and HollowMare shared some infrastructure and code-signing certificate procurement patterns, including certificates issued to Israeli entities, but found the evidence insufficient to attribute both families to the same actor. Researchers advised blocking these utilities in enterprise environments because even apparently functional apps may upload user files to untrusted servers, establish persistence, or alter browser behavior without a second-stage payload.
Aug 14, 2026
Multiple active **social-engineering-driven malware operations** are targeting end users through trusted distribution channels. One campaign, dubbed **GhostPoster**, distributed **17 malicious browser extensions** across *Chrome, Firefox, and Edge* with **840,000+ installs**, using legitimate-sounding names (e.g., “Google Translate in Right Click,” “Youtube Download,” “Ads Block Ultimate”) and evading store reviews for years. The extensions used **steganography** to hide code in PNGs, then extracted payloads to contact attacker infrastructure, enabling credential/data theft, tracking, affiliate-link hijacking, script injection, and HTTP header manipulation to weaken protections. Separately, threat actors are impersonating **Malwarebytes** via trojanized ZIP “installers” (e.g., `malwarebytes-windows-github-io-X.X.X.zip`) and using **DLL sideloading**—pairing a legitimate EXE with a malicious `CoreMessaging.dll`—to execute **infostealers**; reporting highlighted a campaign fingerprint via **behash** `4acaac53c8340a8c236c91e68244e6cb` and distinctive DLL strings used for infrastructure mapping. A different operation identified by CloudSEK involves **“RedLineCyber”** masquerading as an affiliate of “RedLine Solutions” to build credibility inside private **Discord** communities and deliver a Python-based **clipboard hijacker** (often `Pro.exe` / `peeek.exe`) aimed at **cryptocurrency wallet theft**, relying on long-term grooming of high-value targets rather than broad phishing.
Jun 29, 2026