MalwarePublished 22 Aug 2025

Proxyware Malware Being Distributed on YouTube Video Download Site

Source AlienVault OTX General

Description

A malicious campaign is targeting users through fake YouTube video download sites, distributing Proxyware malware. The attack involves a downloader disguised as WinMemoryCleaner, which installs NodeJS and runs malicious JavaScript. This script then installs various Proxyware programs, including DigitalPulse, HoneyGain, and recently, Infatica. The malware uses Task Scheduler for persistence and sends system information to a C&C server. The Proxyware exploits the infected system's network bandwidth for the attacker's profit. Users in South Korea have been particularly targeted. To prevent infection, users should avoid installing executables from suspicious websites and use antivirus software.

Impact

For European organizations, the primary impact of this Proxyware malware is the unauthorized consumption and exploitation of network bandwidth, which can degrade network performance and increase operational costs. The malware's persistence mechanisms and data exfiltration capabilities could also expose sensitive system information, potentially facilitating further targeted attacks or lateral movement within corporate networks. While the malware does not appear to directly steal credentials or cause data destruction, the covert use of network resources can disrupt business operations, especially in bandwidth-sensitive environments. Additionally, infected endpoints may be leveraged as part of larger proxy networks, potentially implicating organizations in malicious activities unknowingly, which could have reputational and legal consequences under European data protection and cybersecurity regulations such as GDPR and NIS Directive. The infection vector—fake YouTube video download sites—targets end users, so organizations with remote or hybrid workforces are at increased risk if employees download software from unverified sources. The use of NodeJS and JavaScript for malware execution also suggests that systems with developer tools or scripting environments enabled are more vulnerable. Overall, the threat could lead to reduced network efficiency, potential compliance issues, and increased incident response costs for European organizations.

Defensive guidance

European organizations should implement a multi-layered defense strategy tailored to this threat. First, enforce strict application control policies to prevent unauthorized installation of software, especially from untrusted websites masquerading as legitimate utilities. Endpoint protection platforms should be configured to detect and block known hashes and behaviors associated with Proxyware malware, including monitoring for suspicious NodeJS installations and Task Scheduler modifications. Network monitoring should be enhanced to detect unusual outbound connections to the identified C&C domains (e.g., cloudnetpr.com, connectiondistribute.com, ferntier.com, a.pairnewtags.com) and anomalous bandwidth usage patterns indicative of proxyware activity. User education campaigns must emphasize the risks of downloading executables from unofficial sources, particularly fake video download sites. Implementing web filtering to block access to known malicious domains and URLs can reduce exposure. Additionally, restrict or monitor the use of scripting environments like NodeJS on endpoints unless explicitly required for business purposes. Regularly audit scheduled tasks and startup entries to identify unauthorized persistence mechanisms. Incident response plans should include procedures for isolating infected machines and conducting forensic analysis to identify the scope of compromise. Finally, collaborate with ISPs and cybersecurity information sharing organizations to stay updated on emerging Proxyware threats and indicators.

Indicators of compromise

Domains 4

cloudnetpr.com
connectiondistribute.com
ferntier.com
a.pairnewtags.com

Hashes 11

037e94519ce35ef944f1dc3f1434d09d
0af46f150e0ffa678d20fcbe5e145576
0af9e224a5469cc47706ab4253d108e9
0e6c41058975c1288da2f41abc5d9345
14c89939209ee3d0d1977a2e92897dfc
011bbd55728f085bd0da46457611920fbd768dc0
0869358592434238f36a1a2261b897d2394294e1
202d8c7e38546371b6c80bea4e999ec75f2ab3a5
62b9f0df18cd0f21f8d87b9f49bc17dcf084b29b0dc3e207aaf508beb5b478e8
833b0e7e72acbd95df085bc4e5010fec19ded9f813f43a808fe33b5e1f4f58e7

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 Aug 2025, 19:19 UTC

MITRE ATT&CK techniques10 from threat tags

Technical details

Indicators of compromise

Domains 4

Hashes 11

Community reviews

Related threats