Trusted Design

Projextor: Abusing Electron in Trojanized Productivity Applications

概要

Projextor is a malware campaign that leverages Electron-based productivity applications to deliver malicious payloads. The threat disguises itself as legitimate document converters, meal planners, and PDF management tools with working user interfaces. Distribution occurs through impersonating websites that mimic genuine services, using high-ranking search results to lure victims. Applications like Kitchen Canvas, Food Formula, DocConvertWizard, and PDFGrip contain insecure Electron configurations that enable dynamic JavaScript execution and desktop capture capabilities. The infection chain begins with NSIS, Squirrel, or Inno Setup installers that download the main Electron application. Preload scripts abuse privileged Node.js APIs with intentionally disabled security features, allowing arbitrary code execution and screen monitoring. This enables threat actors to capture sensitive information, monitor user activity, and execute remote commands while maintaining the appearance of functional productivity soft...

Created: 2026-08-18

Indicators

• FileHash-SHA256 - 4ce5e5768d2f9f71e2835ab8ebc4a2191d436ca3a990a56e9bc264235c7b5b55 -
• domain - doceditorinc.com -
• hostname - conv.doceditorinc.com -
• FileHash-SHA256 - 71656539cc644513396f56100ffb56f9ef9eaa5b7a16b0773d6e5d370a912a88 -
• URL - https://conv.doceditorinc.com/latest/part -
• FileHash-SHA256 - 3c1dbc3f56e91cc79f0014850e773a7f12bbfef06680f08f883b2bf12873eccc -
• FileHash-SHA1 - e387f61298206d5e538fafb5f0f83b5ea72959f8 -
• FileHash-MD5 - 415a96f247ec0477080f576a4b91f7a1 -
• domain - flipformatpdf.com -
• FileHash-MD5 - d749e0f8f2cd4e14178a787571534121 -
• URL - https://pdfgrip.com/ -
• URL - https://kitchen-canvas.com/ -
• FileHash-SHA1 - bb389838978c45391288979ae6c634e61aa61448 -
• FileHash-MD5 - 973c9e55811bf4940a874d3b6e6e2e0c -
• FileHash-MD5 - b648ec0880e9f5421fdb380e620b6173 -
• FileHash-SHA256 - a799417bd79060d63e93682f339fbe2868de3881f9c5865d9b583f5b715c70a9 -
• URL - https://doceditorinc.com/ -
• FileHash-SHA1 - 04cc663812883562b762d184266e1457e98b7de8 -
• URL - https://doceditorinc.com -
• URL - https://flipformatpdf.com/ -
• FileHash-SHA256 - e7bc36c7345b3894bc1da3d18ff3dbf0a20713d17b93a585ac0da65776d29027 -
• URL - https://meal-formula.com/ -
• FileHash-SHA256 - d50ca2fa212df1c1ff69b5d26ba594bd39bfd86a71b068a650cc577e5dc9a94e -
• URL - https://doceditor.in -
• FileHash-SHA1 - f7a060bc408acfb14ce59e40710b630291c76540 -
• domain - meal-formula.com -
• FileHash-SHA256 - c21eb14ba63e943db5ea9ab64af02a50a17260c7d8538a133c4f6e0957d36f47 -
• domain - pdfgrip.com -
• domain - doceditor.in -

類似Pulses

類似するPulseは見つかりませんでした。

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る