A malware campaign distributing potentially unwanted applications (PUAs) named ImageLooker.exe and Calendaromatic.exe uses digitally signed binaries and deceptive packaging to evade detection. Delivered via self-extracting 7-Zip archives, these trojanized productivity tools leverage the NeutralinoJS framework and Unicode homoglyphs. The campaign employs SEO poisoning and malvertising to trick users into installing the malware, which includes browser hijackers and facilitates initial access and data exfiltration. This reflects advanced threat actor tactics abusing digital code signing and user behavior manipulation.