Projextor: Abusing Electron in Trojanized Productivity Applications
Projextor is a malware campaign that leverages Electron-based productivity applications to deliver malicious payloads. The threat disguises itself as legitimate document converters, meal planners, and PDF management tools with working user interfaces. Distribution occurs through impersonating websites that mimic genuine services, using high-ranking search results to lure victims. Applications like Kitchen Canvas, Food Formula, DocConvertWizard, and PDFGrip contain insecure Electron configurations that enable dynamic JavaScript execution and desktop capture capabilities. The infection chain begins with NSIS, Squirrel, or Inno Setup installers that download the main Electron application. Preload scripts abuse privileged Node.js APIs with intentionally disabled security features, allowing arbitrary code execution and screen monitoring. This enables threat actors to capture sensitive information, monitor user activity, and execute remote commands while maintaining the appearance of functional productivity soft...
AI Analysis
Technical Summary
Projextor is a malware campaign leveraging trojanized Electron-based productivity applications like Kitchen Canvas, Food Formula, DocConvertWizard, and PDFGrip. These applications have insecure Electron configurations that permit dynamic JavaScript execution and desktop capture capabilities. The infection chain begins with NSIS, Squirrel, or Inno Setup installers that download the main Electron application. Preload scripts abuse privileged Node.js APIs with intentionally disabled security features, enabling arbitrary code execution and screen monitoring. Distribution is via impersonation websites mimicking legitimate services, using high-ranking search results to lure victims. The malware captures sensitive information, monitors user activity, and executes remote commands while maintaining the appearance of legitimate functionality.
Potential Impact
The malware enables threat actors to execute arbitrary code on the victim's system, capture screen content, monitor user activity, and execute remote commands. This compromises sensitive information and user privacy while maintaining a facade of legitimate application functionality, increasing the likelihood of prolonged undetected presence.
Mitigation Recommendations
No official patch or remediation guidance is provided. Users should avoid downloading Electron-based productivity applications from untrusted sources or impersonation websites. Employ application whitelisting and verify software authenticity before installation. Monitor for suspicious installer behaviors such as unexpected network downloads. Since this is a malware campaign abusing insecure Electron configurations, developers should ensure secure Electron app configurations and disable privileged Node.js API access in preload scripts.
Indicators of Compromise
- domain: pdfgrip.com
- hash: d749e0f8f2cd4e14178a787571534121
- hash: 04cc663812883562b762d184266e1457e98b7de8
- hash: 3c1dbc3f56e91cc79f0014850e773a7f12bbfef06680f08f883b2bf12873eccc
- url: https://flipformatpdf.com/
- url: https://kitchen-canvas.com/
- url: https://pdfgrip.com/
- hash: 415a96f247ec0477080f576a4b91f7a1
- hash: 973c9e55811bf4940a874d3b6e6e2e0c
- hash: b648ec0880e9f5421fdb380e620b6173
- hash: bb389838978c45391288979ae6c634e61aa61448
- hash: e387f61298206d5e538fafb5f0f83b5ea72959f8
- hash: f7a060bc408acfb14ce59e40710b630291c76540
- hash: 4ce5e5768d2f9f71e2835ab8ebc4a2191d436ca3a990a56e9bc264235c7b5b55
- hash: 71656539cc644513396f56100ffb56f9ef9eaa5b7a16b0773d6e5d370a912a88
- hash: a799417bd79060d63e93682f339fbe2868de3881f9c5865d9b583f5b715c70a9
- hash: c21eb14ba63e943db5ea9ab64af02a50a17260c7d8538a133c4f6e0957d36f47
- hash: d50ca2fa212df1c1ff69b5d26ba594bd39bfd86a71b068a650cc577e5dc9a94e
- hash: e7bc36c7345b3894bc1da3d18ff3dbf0a20713d17b93a585ac0da65776d29027
- url: https://conv.doceditorinc.com/latest/part
- url: https://doceditor.in
- url: https://doceditorinc.com
- url: https://doceditorinc.com/
- url: https://meal-formula.com/
- domain: doceditor.in
- domain: doceditorinc.com
- domain: flipformatpdf.com
- domain: meal-formula.com
- domain: conv.doceditorinc.com
Projextor: Abusing Electron in Trojanized Productivity Applications
Description
Projextor is a malware campaign that leverages Electron-based productivity applications to deliver malicious payloads. The threat disguises itself as legitimate document converters, meal planners, and PDF management tools with working user interfaces. Distribution occurs through impersonating websites that mimic genuine services, using high-ranking search results to lure victims. Applications like Kitchen Canvas, Food Formula, DocConvertWizard, and PDFGrip contain insecure Electron configurations that enable dynamic JavaScript execution and desktop capture capabilities. The infection chain begins with NSIS, Squirrel, or Inno Setup installers that download the main Electron application. Preload scripts abuse privileged Node.js APIs with intentionally disabled security features, allowing arbitrary code execution and screen monitoring. This enables threat actors to capture sensitive information, monitor user activity, and execute remote commands while maintaining the appearance of functional productivity soft...
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Projextor is a malware campaign leveraging trojanized Electron-based productivity applications like Kitchen Canvas, Food Formula, DocConvertWizard, and PDFGrip. These applications have insecure Electron configurations that permit dynamic JavaScript execution and desktop capture capabilities. The infection chain begins with NSIS, Squirrel, or Inno Setup installers that download the main Electron application. Preload scripts abuse privileged Node.js APIs with intentionally disabled security features, enabling arbitrary code execution and screen monitoring. Distribution is via impersonation websites mimicking legitimate services, using high-ranking search results to lure victims. The malware captures sensitive information, monitors user activity, and executes remote commands while maintaining the appearance of legitimate functionality.
Potential Impact
The malware enables threat actors to execute arbitrary code on the victim's system, capture screen content, monitor user activity, and execute remote commands. This compromises sensitive information and user privacy while maintaining a facade of legitimate application functionality, increasing the likelihood of prolonged undetected presence.
Defensive Guidance
No official patch or remediation guidance is provided. Users should avoid downloading Electron-based productivity applications from untrusted sources or impersonation websites. Employ application whitelisting and verify software authenticity before installation. Monitor for suspicious installer behaviors such as unexpected network downloads. Since this is a malware campaign abusing insecure Electron configurations, developers should ensure secure Electron app configurations and disable privileged Node.js API access in preload scripts.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://blog.gdatasoftware.com/2026/08/38468-projextor-abusing-electron"]
- Pulse Id
- 6a8325c63ec6c1f8d93275f6
Indicators of Compromise
Domain
| Value | Description | Copy |
|---|---|---|
domainpdfgrip.com | — | |
domaindoceditor.in | — | |
domaindoceditorinc.com | — | |
domainflipformatpdf.com | — | |
domainmeal-formula.com | — | |
domainconv.doceditorinc.com | — |
Hash
| Value | Description | Copy |
|---|---|---|
hashd749e0f8f2cd4e14178a787571534121 | — | |
hash04cc663812883562b762d184266e1457e98b7de8 | — | |
hash3c1dbc3f56e91cc79f0014850e773a7f12bbfef06680f08f883b2bf12873eccc | — | |
hash415a96f247ec0477080f576a4b91f7a1 | — | |
hash973c9e55811bf4940a874d3b6e6e2e0c | — | |
hashb648ec0880e9f5421fdb380e620b6173 | — | |
hashbb389838978c45391288979ae6c634e61aa61448 | — | |
hashe387f61298206d5e538fafb5f0f83b5ea72959f8 | — | |
hashf7a060bc408acfb14ce59e40710b630291c76540 | — | |
hash4ce5e5768d2f9f71e2835ab8ebc4a2191d436ca3a990a56e9bc264235c7b5b55 | — | |
hash71656539cc644513396f56100ffb56f9ef9eaa5b7a16b0773d6e5d370a912a88 | — | |
hasha799417bd79060d63e93682f339fbe2868de3881f9c5865d9b583f5b715c70a9 | — | |
hashc21eb14ba63e943db5ea9ab64af02a50a17260c7d8538a133c4f6e0957d36f47 | — | |
hashd50ca2fa212df1c1ff69b5d26ba594bd39bfd86a71b068a650cc577e5dc9a94e | — | |
hashe7bc36c7345b3894bc1da3d18ff3dbf0a20713d17b93a585ac0da65776d29027 | — |
Url
| Value | Description | Copy |
|---|---|---|
urlhttps://flipformatpdf.com/ | — | |
urlhttps://kitchen-canvas.com/ | — | |
urlhttps://pdfgrip.com/ | — | |
urlhttps://conv.doceditorinc.com/latest/part | — | |
urlhttps://doceditor.in | — | |
urlhttps://doceditorinc.com | — | |
urlhttps://doceditorinc.com/ | — | |
urlhttps://meal-formula.com/ | — |
Threat ID: 6a842553bf8831d53988213e
Added to database: 08/18/2026, 09:26:43 UTC
Last enriched: 08/18/2026, 10:55:06 UTC
Last updated: 10/02/2026, 01:43:55 UTC
Views: 95
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.