Threat actors are distributing Projextor malware through fully functional productivity applications built with the Electron framework, using legitimate-looking software to disguise malicious activity.
The campaign targets users searching for free PDF converters, document editors, meal planners, recipe applications, and similar desktop utilities.
Security researchers found that applications including Kitchen Canvas, Food Formula, DocConvertWizard, and PDF Grip perform their advertised functions while simultaneously containing hidden malicious components.
The technique makes the campaign particularly concerning because victims may not immediately suspect that anything is wrong.
Unlike fake applications that fail to provide promised functionality, the malicious programs can operate normally and present convincing interfaces.
This allows attackers to establish trust while malicious JavaScript components execute in the background. Researchers have compared the approach with previous software distribution campaigns such as TamperedChef, where threat actors used search-engine visibility and deceptive productivity tools to reach potential victims.
The malware is distributed through websites designed to resemble legitimate document-processing services. One observed domain, doceditorinc[.]com, was designed to look similar to the legitimate doceditor[.]in service.
Victims are encouraged to download an installer that subsequently retrieves the main Electron application. Researchers observed different installer technologies, including NSIS, Squirrel Installer, and Inno Setup, but the packages ultimately delivered the same second-stage application containing the malicious components.
One analyzed sample, PDFGrip_646990.exe, contains a download reference pointing to conv[.]doceditorinc[.]com/latest/part.
The resulting application contains modified main.js and preload.js files. These components are particularly important because Electron applications rely heavily on JavaScript to control application behavior and interact with operating-system functionality.
Electron combines the Chromium browser engine with Node.js, allowing developers to create cross-platform desktop applications using familiar web technologies such as HTML, CSS, and JavaScript. However, the framework can also provide applications with access to local files, operating-system resources, process execution, and inter-process communication. When security settings are weakened, malicious code can potentially abuse these capabilities.
Projextor takes advantage of this architecture. Its main.js component automatically loads preload.js when the application starts, allowing malicious functionality to be initialized before users interact with the visible application interface.
Researchers identified insecure Electron configuration choices, including contextIsolation: false, which can expose privileged Node.js functionality to application content. Modern Electron releases enable context isolation by default, making its deliberate deactivation a significant security concern.
The malware also uses disableOldBuildWarning to suppress warnings associated with outdated Electron versions. This can prevent users from receiving useful security notifications about software running on potentially vulnerable framework versions.
Another important capability is Projextor’s ability to dynamically load and execute JavaScript from a dedicated injection directory.
This architecture could allow attackers to modify malicious functionality or introduce additional capabilities without replacing the entire application. Such functionality could potentially support further payload delivery, data theft, or unauthorized code execution.
Researchers also identified desktop-capture functionality within the malicious applications. Projextor’s preload script can enumerate monitors and application windows, communicate through Electron IPC channels, display capture-source thumbnails, and facilitate screen selection.
Although screen-capture functionality can be legitimate in productivity software, its presence alongside arbitrary JavaScript execution creates significant security risks.
Organizations should avoid downloading desktop utilities from unfamiliar websites and should verify software publishers before installation.
Security teams should monitor endpoints for suspicious Electron applications, unexpected outbound connections, unusual child processes, and modified application resources.
Indicators of compromise, including known Projextor hashes and associated infrastructure, should also be incorporated into endpoint and threat-intelligence monitoring systems.
The campaign demonstrates how attackers can abuse trusted software frameworks rather than relying on obviously malicious programs.
For users and organizations, the combination of legitimate functionality, deceptive distribution websites, and malicious Electron components makes Projextor a significant example of how modern malware campaigns are evolving.
No Comment! Be the first one.