MalwarePublished 21 Nov 2025

Reoccurring Use of Highly Suspicious PDF Editors to Infiltrate Environments

Source AlienVault OTX General

Description

Since November 19, 2025, a suspicious PDF editor named 'ConvertMate' has been identified as a malicious vector infiltrating environments. Although it appears as a legitimate PDF converter, it performs unauthorized external connections, host queries, and creates artifacts indicative of compromise. It executes a PowerShell script that installs a scheduled task to repeat its malicious behavior every 24 hours. This activity closely resembles the earlier 'PDFEditor' campaign, with both files signed by the same entity, suggesting a coordinated threat actor. Immediate isolation and removal of 'ConvertMate' and related artifacts are critical. End-user training to recognize suspicious files and ads is also recommended. The threat does not require user interaction beyond initial download and installation, and no known exploits are publicly reported yet. The medium severity reflects its persistence and stealth but limited current exploitation scope.

Impact

For European organizations, this threat poses a risk of persistent compromise through a seemingly legitimate application, potentially leading to unauthorized data access, espionage, or lateral movement within networks. The scheduled task ensures the malware maintains foothold, increasing the difficulty of eradication. Organizations relying on PDF editing tools or with users prone to downloading software from unverified sources are particularly vulnerable. The external connections could facilitate data exfiltration or command-and-control communications, risking confidentiality breaches. The stealthy nature and persistence mechanisms could disrupt business operations if critical systems are affected. Additionally, the threat could be leveraged to deploy further payloads or ransomware, amplifying impact. The medium severity suggests that while the threat is not currently widespread or highly destructive, it has significant potential to cause harm if not addressed promptly.

Defensive guidance

1. Immediately identify and isolate any systems with 'ConvertMate' installed using the provided file hashes and domain indicators. 2. Remove the software and all related artifacts, including scheduled tasks and PowerShell scripts, to prevent persistence. 3. Implement strict application whitelisting to block unauthorized PDF editors or unknown software installations. 4. Monitor network traffic for connections to the suspicious domains listed and block them at the firewall or proxy level. 5. Conduct user awareness training focused on recognizing malicious ads, suspicious downloads, and the risks of installing unverified software. 6. Employ endpoint detection and response (EDR) solutions to detect and remediate suspicious PowerShell activity and scheduled task creation. 7. Regularly audit scheduled tasks and startup items for unauthorized entries. 8. Maintain updated threat intelligence feeds to detect emerging variants or related campaigns. 9. Enforce least privilege principles to limit the ability of malware to create scheduled tasks or execute scripts. 10. Perform thorough incident response investigations on affected hosts to ensure complete eradication and identify potential lateral movement.

Summary

The threat involves a malicious software masquerading as a PDF editor named 'ConvertMate,' first observed in November 2025. This file is distributed via specific suspicious domains and initially appears benign. However, upon execution, it initiates unauthorized external network connections and performs host queries, indicating reconnaissance or command-and-control communication. It also creates multiple artifacts on the host system, including the execution of a PowerShell script that adds a scheduled task to maintain persistence by repeating the suspicious activity every 24 hours. The behavior and digital signature link it to a previous campaign known as 'PDFEditor,' suggesting the same threat actor or group is behind both. The campaign leverages social engineering by presenting itself as a useful PDF converter, thus tricking users into installing it. The lack of a CVE or known public exploits indicates it is a relatively new or targeted threat. The scheduled task mechanism ensures ongoing access and potential data exfiltration or lateral movement within compromised networks. The threat intelligence source recommends immediate isolation and removal of the software and related artifacts, alongside user awareness training to prevent infection via malicious ads or downloads.

Indicators of compromise

Domains 5

chrialletworton.com
climatcon.com
dcownil.com
trm.conmateapp.com
vo.takelecon.com

Hashes 12

192b80bab47bce9b96f683409db2fe61
2df67805a1ef4c69b1de46e484fde896
4f6d977574cba1eaae21406d60a93e9c
ac2abc01b351aca0359a8d2bf0f3a78a
0f0e7f2098ffbe68c40969fbd6db30a164a3008f
96d267ef0df898a8351b5ce1f960b223440128e8
a1e5b15089203f455b9b9e8ce52ab3f5f086cdd5
c60c964e4e0d40e5d038950d75db60b84d4cd911
08b9f93000512b45f8c2e8d3d6624536b366e67c40fd4b958db58e3a1d129c3d
09c2af472ab86b62a702e94a39df2bef09205f4249ed871cbeece751c1e7ef4f

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 21 Nov 2025, 09:53 UTC

Technical details

Indicators of compromise

Domains 5

Hashes 12

Community reviews

Related threats