Kiran 
A newly documented malware cluster is hiding inside the software people trust most: the free document converters, meal planners, and productivity utilities they download to get work done faster.
Researchers at G Data’s tech blog have detailed a campaign they call Projextor, which abuses the Electron framework to smuggle remote code execution and screen-capture capabilities into fully functional desktop applications.
Projextor follows a pattern security researchers have flagged before in campaigns like TamperedChef: threat actors buy or build high-ranking websites offering legitimate-sounding tools, then use them to distribute installers that actually work.
Projextor Malware Hides in Fake PDF Tools
Victims download apps such as Kitchen Canvas, “Food or Meal Formula,” DocConvertWizard, and various PDF conversion utilities, all of which perform their advertised functions while quietly embedding the same malicious framework.
One distribution site, doceditorinc[.]com, was crafted to closely mimic the legitimate service doceditor[.]in, a classic typosquat that exploits misplaced trust in search results.
Because the software genuinely converts documents or plans meals as promised, users have little reason to suspect anything is wrong.
The first stage is typically a conventional installer, packaged using NSIS, Squirrel, or Inno Setup, that retrieves a second-stage Electron application. In one analyzed sample, PDFGrip_646990.exe, an NSIS script pulled a payload from conv.doceditorinc[.]com, delivering the malicious main.js and preload.js files that power the campaign’s core functionality.
These files are dropped into standard Electron resource paths under %AppData%, where they execute automatically on startup, before the visible interface even loads.
Electron apps normally isolate untrusted web content from privileged Node.js system access using a setting called contextIsolation.
Projextor’s samples deliberately set contextIsolation to false, a configuration that must be manually overridden by a developer, since it defaults to true in modern Electron releases.
Combined with the disabled security warnings via disableOldBuildWarning, this suggests an intentional weakening of the application rather than an accidental misconfiguration.
The most alarming capability is dynamic JavaScript loading: the app can fetch and execute new code modules from a dedicated injection directory at any time after installation, letting operators add functionality remotely without ever touching the original binary.
Projextor also implements a custom desktop-capture interface, enumerating windows and monitors and requesting capture sources through Electron’s IPC channel.
Unlike credential-stealing malware that hunts for stored secrets, this technique can expose live, on-screen data: authentication flows, confidential documents, or activity inside email and collaboration tools, all without leaving the traditional forensic footprint of a keylogger or infostealer.
Despite differing names and use cases, every sample examined shared an identical Electron scaffold, main.js structure, and preload logic, strongly indicating a shared codebase or builder rather than independent development. Researchers stop short of attributing the cluster to a single threat actor, noting the evidence doesn’t yet confirm centralized operation.
The takeaway for defenders and everyday users alike is uncomfortable but simple: functional software is no longer proof of safe software. Verifying download sources, scrutinizing installer origins, and monitoring for unexpected outbound connections from productivity tools are now essential hygiene, not optional caution.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
