Potentially Unwanted Applications (PUAs) weaponized for covert delivery

A malware campaign distributing potentially unwanted applications (PUAs) named ImageLooker.exe and Calendaromatic.exe uses digitally signed binaries and deceptive packaging to evade detection. Delivered via self-extracting 7-Zip archives, these trojanized productivity tools leverage the NeutralinoJS framework and Unicode homoglyphs. The campaign employs SEO poisoning and malvertising to trick users into installing the malware, which includes browser hijackers and facilitates initial access and data exfiltration. This reflects advanced threat actor tactics abusing digital code signing and user behavior manipulation.

• QuartzLine: A working PDF viewer with a backdoor insideMalware2026-10-16
• Placeholder Domains Whose Ads Serve ScamsCampaign2026-09-26
• Ten Minutes to Containment: How Agentic MXDR Scoped a Fake Claude Desktop IntrusionMalware2026-08-24
• Dropcatch Scavengers: Expired Malicious Domains Become Cash CowsMalware2026-08-14
• Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRATMalware2026-07-23