A recent malware campaign, dubbed Projextor, has been discovered embedding malicious code within seemingly legitimate desktop applications. These applications, including document converters and meal planners, function as advertised, making it challenging for users to detect the underlying threat. The malware is distributed through deceptive download sites and installers that mimic free productivity software. Upon execution, these installers retrieve Electron-based applications that seamlessly integrate harmful behavior with expected functionalities, such as file operations and system resource usage.
Security analysts have identified a cluster of applications sharing this concealed framework. These apps remain operational while harboring code with extensive access privileges, posing significant risks to both individuals and organizations. Notably, Projextor can introduce new scripts post-installation and includes screen-capture features capable of exposing sensitive information like documents, browser sessions, emails, and collaboration tools. The functional nature of these applications means users may not suspect any malicious activity, underscoring the inadequacy of visual trust as a security measure.
Exploiting Electron’s Capabilities
Electron, a popular framework for developing desktop software using web technologies, provides applications with access to operating system functions. Projextor exploits this trusted structure by placing its main.js and preload.js files in the application’s resources directory, ensuring automatic execution upon program launch. The preload layer typically serves as a controlled bridge between the visible application and powerful system functions. However, in the compromised samples, main.js deliberately disables Electron’s context isolation—a default safeguard in modern versions—potentially granting content loaded by the app access to Node.js capabilities.
Researchers have observed that the malware can load and execute JavaScript modules from a dedicated injection directory. This design transforms the initial download into a flexible base rather than a fixed payload, mirroring risks associated with previous Electron framework malware campaigns where Electron’s access to local resources facilitated data theft. The deceptive interface behavior reduces obvious warning signs, allowing the installation to appear as routine software use. The first-stage installers vary, utilizing NSIS, Squirrel Installer, or Inno Setup, but all deliver the same second-stage style of application. One captured sample contained a download address in its NSIS script, illustrating how familiar installer formats can quietly fetch more capable components after initiation.
Enhanced Risk Through Screen Capture
Projextor also features a custom screen-sharing picker that lists available monitors and application windows, complete with thumbnails. While screen capture is not inherently malicious, its inclusion alongside arbitrary script execution within tools marketed for everyday productivity raises significant concerns. If exploited, this capability could enable an attacker to monitor active work, collect sensitive files displayed on screen, and observe sign-in workflows. Unlike stolen saved passwords, screen capture can reveal information visible only during live sessions, including content in browsers, email clients, and business applications. This threat echoes previous malware targeting screen activity, highlighting that data visible during use can be as valuable as stored credentials.
The shared main.js and preload.js design suggests a common campaign or code base, although researchers have not confirmed whether the same actor built or operated every application. The practical takeaway is clear: download software only from verified sources, confirm the publisher’s authenticity, and be cautious of sites offering free productivity tools without proper validation.
The emergence of Projextor underscores the evolving sophistication of malware campaigns that exploit trusted frameworks like Electron. By embedding malicious code within functional applications, attackers can bypass traditional security measures and user scrutiny. This development highlights the critical need for users and organizations to exercise vigilance when downloading and installing software, even from seemingly reputable sources. Implementing robust security practices, such as verifying software origins and monitoring for unusual application behaviors, is essential in mitigating such stealthy threats.
