A new malware campaign is blurring the line between potentially unwanted programs (PUPs) and full-fledged trojans.
Researchers at Expel uncovered that apps like ManualFinder, OneStart, AppSuite-PDF, and PDF Editor initially presented as free productivity tools are secretly installing malicious payloads, creating persistence, and in some cases converting victim machines into residential proxies.
Distribution begins with aggressive ad campaigns promoting PDF readers and desktop utilities. These ads redirect users to professional-looking landing pages, which frequently lack genuine product information or legitimate download links.
Instead, bundled installers fetch malware-laced MSI files, disguising themselves as helpful software.
Persistence Through Scheduled Tasks and Node.js
Expel’s investigation began with a suspicious scheduled task executing via MSHTA.exe. Analysis revealed that the task launched ManualFinderApp.exe, a trojanized application masquerading as a helpful manual search tool.
Behind the façade, the installer used msiexec with quiet flags (/qn) to deploy payloads without user interaction.
EDR telemetry showed persistence achieved through Node.js execution of JavaScript droppers stored in %TEMP%. For example:
textcmd.exe /d /s /c "msiexec /qn /i C:\Users\<user>\AppData\Local\Temp\ManualFinder-v2.0.196.msi"
The parent chain traced back to scheduled tasks via svchost.exe -k netsvcs -s Schedule, confirming stealthy persistence.
Notably, the malware connected to mka3e8[.]com, a domain linked to prior unwanted software campaigns, including OneStart Browser. VirusTotal records show more than 70 malicious JavaScript samples have communicated with this domain.
Code-Signing Abuse and the Risk of “Free”
A significant red flag was the use of questionable code-signing certificates. ManualFinder was signed by GLINT SOFTWARE SDN. BHD., a Malaysian-registered entity with little public footprint.
Additional malware-linked apps were signed using ECHO INFINI SDN. BHD. and Summit Nexus Holdings LLC, the latter tied to addresses previously documented in fraud schemes.
Such rotating, inconsistent certificate usage undermines the trust model of code signing and indicates a coordinated malware distribution network.
Researchers also observed PDF Editor prompting users to consent to their devices being used as residential proxies. This activity not only degrades privacy but also risks victims’ IPs being weaponized in cybercrime.
Mitigation and Hunting Guidance
Expel recommends organizations remove software signed by the suspicious certificate authorities, and block associated domains such as mka3e8[.]com. Endpoint teams should look for scheduled tasks launching Node. js-based scripts from %TEMP% directories.
A Defender XDR hunting query provided by the community detects this activity by filtering for node.exe processes tied to JavaScript executables with GUID-like filenames.The query highlights network connections, unique IPs, and associated users, helping SOCs spot lateral distribution.
Security analysts warn that campaigns like this demonstrate how PUP ecosystems are evolving into stealthier malware delivery channels. What looks like “free software” may, in fact, be establishing long-term persistence, exfiltrating browser data, or weaponizing endpoints for proxy networks.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
.jpg?fit=1068,580&ssl=1&description=Ad-Based Malware - A new malware campaign is blurring the line between potentially unwanted programs (PUPs) and full-fledged trojans.){kind=link}