CampaignPublished 23 Sep 2025

Artificial Intelligence Exposes the Homoglyph Hustle

Source AlienVault OTX General

Description

A seemingly harmless desktop application named calendaromatic.exe was discovered to be a sophisticated malware utilizing NeutralinoJS, Unicode homoglyphs, and hidden payloads. The malware, distributed through an aggressive ad campaign, exploited NeutralinoJS's native APIs to interact directly with the host operating system. The key to its operation was a function named clean() that scanned for Unicode homoglyphs in holiday JSON data, using them to encode hidden instructions. This technique allowed the malware to receive and execute arbitrary code smuggled into holiday names using lookalike characters. The investigation was accelerated by AI, which helped parse and annotate the minified JavaScript code.

Impact

For European organizations, this malware poses a medium-level threat with potential significant impacts on confidentiality, integrity, and availability. The use of Unicode homoglyphs as a covert channel allows the malware to evade traditional detection mechanisms that rely on signature or heuristic analysis of code and data. This stealthy communication method can facilitate the execution of arbitrary code, potentially leading to unauthorized access, data exfiltration, or persistence within critical systems. Organizations using NeutralinoJS-based desktop applications or those that might inadvertently install calendaromatic.exe through aggressive ad campaigns are at risk. The malware’s ability to interact directly with the host OS via native APIs increases the risk of system compromise, lateral movement, and execution of further payloads. The medium severity reflects that while exploitation requires user execution (installing or running the malicious app), the complexity and novelty of the homoglyph encoding technique make detection and mitigation challenging. European entities with sensitive data or critical infrastructure could face operational disruptions or data breaches if infected. The lack of known exploits in the wild suggests the threat is emerging but warrants proactive attention.

Defensive guidance

1. Implement advanced detection mechanisms that analyze Unicode characters and homoglyph usage in application data and logs to identify suspicious encoding patterns. 2. Employ strict application whitelisting and code signing policies to prevent execution of unauthorized desktop applications like calendaromatic.exe. 3. Monitor and restrict the use of NeutralinoJS-based applications, especially those sourced from untrusted or aggressive advertising campaigns. 4. Enhance endpoint detection and response (EDR) solutions to detect anomalous API calls made by JavaScript-based desktop applications interacting with the OS. 5. Conduct user awareness training focused on the risks of installing applications from aggressive or unsolicited advertisements. 6. Use AI-assisted code analysis tools to deobfuscate and analyze suspicious JavaScript code, improving early detection of similar threats. 7. Regularly audit and monitor JSON and other data files for unexpected Unicode characters or obfuscated content that could serve as covert channels. 8. Apply network segmentation and restrict outbound connections from endpoints to limit malware command and control communications. 9. Maintain up-to-date threat intelligence feeds and indicators of compromise (IOCs) to quickly identify and respond to infections. 10. Since no patches are available, prioritize detection and containment strategies until official remediation or updates are released.

Indicators of compromise

Hashes 10

8b9ad525283aa40a1af0a6b0d3e5b94d
a2cb30e15104660533baa71dfcca9613
d6951153ad26cc86cd06fde37530e4f4
7430db4c3a2a7465a19d453e41a7a9d34ceb33e9
796a0393c6411b3af155cf98c029d002a439f5b1
dc0a40c8f2279c223ad2f832fc3c894ae0be7ec6
497ed5bca59fa6c01f80d55c5f528a40daff4e4afddfbe58dbd452c45d4866a3
69934dc1d4fdb552037774ee7a75c20608c09680128c9840b508551dbcf463ad
c24774d9b3455b47a41c218d404ae6b702da0d2e3e8ad3d2a353ffddd62239c2
e32d6b2b38b11db56ae5bce0d5e5413578a62960aa3fab48553f048c4d5f91f0

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 23 Sep 2025, 21:57 UTC

MITRE ATT&CK techniques10 from threat tags

Technical details

Indicators of compromise

Hashes 10

Community reviews

Related threats