Attackers distribute trojanized installers impersonating Foxit PDF Reader, leveraging its trusted reputation to bypass user suspicion. These installers present decoy images while downloading malicious MSI packages that install UltraVNC remote access software disguised as GPU drivers. The malware achieves persistence through registry modifications and firewall rule changes, connecting to attacker-controlled infrastructure for full remote system control. This campaign uses social engineering and brand impersonation instead of exploiting technical vulnerabilities. Telemetry shows broad distribution in multiple countries. No CVE or known exploits in the wild are reported. Indicators include multiple file hashes and URLs associated with the malicious infrastructure.

The impact includes unauthorized remote access and control of infected systems, persistence on the victim machines, and potential data compromise or further malicious activity. Since the attack does not exploit software vulnerabilities but relies on user deception, the risk depends heavily on user interaction with the fake installers. The campaign affects users in Germany, the United States, the United Kingdom, and Ukraine, indicating a broad geographic reach.

No official patch or vendor advisory is available for this threat as it does not exploit a software vulnerability but relies on social engineering and brand impersonation. Mitigation focuses on user awareness to avoid executing suspicious installers, verifying software sources, and blocking known malicious URLs and file hashes through endpoint protection and network defenses. Organizations should monitor for the listed indicators of compromise and restrict installation privileges to prevent unauthorized software execution.