Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A global malware infection of Windows computers has been uncovered, stemming from software users installed themselves. The malware, disguised as legitimate PDF editors and manual finders, turns infected systems into residential proxies for malicious actors. The infection chain starts with deceptive ads posing as PDF manuals. The campaign, which appears to have ceased, was widespread due to large-scale advertising. The malware creates scheduled tasks, executes JavaScript files, and communicates with various C2 domains. It's potentially linked to the OneStart Browser, known for spreading spyware and adware. Authorities advise blocking access to related domains, checking for specific applications, and removing software signed by certain certificate issuers.

A recent malware campaign targeting Windows systems has been uncovered, involving malicious software disguised as legitimate PDF editors and manual finder tools. The infection vector primarily involved deceptive online advertisements that tricked users into downloading and installing these fake applications under the guise of accessing PDF manuals. Once installed, the malware establishes persistence by creating scheduled tasks and executing JavaScript files to maintain control over the infected system. It communicates with multiple command and control (C2) domains to receive instructions and potentially exfiltrate data. A notable aspect of this campaign is that infected machines are repurposed as residential proxies, allowing threat actors to route malicious traffic through these compromised endpoints, thereby masking their activities and complicating attribution. The campaign is potentially linked to the OneStart Browser, a known distributor of spyware and adware, suggesting a broader ecosystem of unwanted software distribution. The malware employs various techniques consistent with MITRE ATT&CK tactics such as scheduled task creation (T1053.005), script execution (T1059.007), masquerading (T1036.005), user execution (T1204.002), code signing abuse (T1553.002), signed binary proxy execution (T1218.007), persistence mechanisms (T1547.001), data staging (T1102.002), obfuscated files or information (T1027.002), and command and control communication (T1071.001). Although the campaign appears to have ceased, its widespread nature was facilitated by large-scale advertising campaigns, increasing the infection footprint globally. Authorities recommend blocking access to associated domains, auditing systems for suspicious applications, and removing software signed by specific certificate issuers linked to the malware distribution chain.

Detailed information about New malware campaign discovered via ManualFinder. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'certificate abuse'

Filter Threats

Threats Tagged 'certificate abuse'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility