Threat actors are using fully functional productivity applications to deliver Projextor malware through the same Electron framework used by many popular desktop apps.
The campaign targets users searching for free PDF converters, document editors, meal planners, and recipe tools.
Researchers identified several Electron-based applications, including Kitchen Canvas, Food Formula, DocConvertWizard, PDF Grip, and other tools marketed under different names.
While the programs perform their advertised tasks, they contain the same hidden malicious components.
This approach makes detection harder. Users may trust the application because it has a working interface and appears useful.
Similar campaigns, including TamperedChef, have previously used high-ranking websites and fake productivity software to lure victims.
Projextor Abuses Electron Framework
The malware is distributed through websites impersonating legitimate document-processing services. One observed domain, doceditorinc[.]com, appears designed to resemble the legitimate doceditor[.]in service.
Victims download an installer that retrieves the main Electron application. Samples use NSIS, Squirrel Installer, or Inno Setup packaging. Although the installer formats differ, they all deliver the same second-stage application.
For example, the file PDFGrip_646990.exe contains a download link pointing to conv[.]doceditorinc[.]com/latest/part. The downloaded payload includes malicious main.js and preload.js files.
Electron applications combine Chromium and Node.js, allowing developers to create desktop software with HTML, CSS, and JavaScript.
However, Electron also provides access to local files, operating-system resources, process execution, and inter-process communication.
Projextor abuses these capabilities. Its main.js file automatically loads preload.js when the application starts. The scripts are stored inside the application’s resources directory, allowing them to run before the visible interface appears.
The malicious applications deliberately use insecure Electron settings. Notably, they set contextIsolation: false, exposing privileged Node.js capabilities to content loaded by the application.
Modern Electron versions enable context isolation by default, so disabling it requires an explicit developer decision.
The malware also disables old-build security warnings through disableOldBuildWarning. This prevents users from seeing alerts about outdated and insecure Electron versions.
A major concern is the ability to dynamically load and execute JavaScript from a dedicated injection directory.
This gives attackers a way to add or modify malicious features after installation without replacing the full application. It could enable remote code execution, data theft, or further payload delivery.
Projextor also includes desktop-capture functionality. Its preload script can enumerate monitors and open windows through Electron IPC channels, display capture-source thumbnails, and allow screen selection.
While screen sharing is not malicious by itself, it becomes dangerous when embedded in a suspicious application with arbitrary JavaScript execution, gdatasoftware said.
Indicators of Compromise
| Type | Indicator | Associated File / Details | Detection |
|---|---|---|---|
| SHA-256 | A799417BD79060D63E93682F339FBE2868DE3881F9C5865D9B583F5B715C70A9 | FlipFormat_610220.exe | Win32.Malware.Projextor.E |
| SHA-256 | 71656539CC644513396F56100FFB56F9EF9EAA5B7A16B0773D6E5D370A912A88 | PDFGr |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
