Risk actors behind the Projextor marketing campaign are abusing Electron-based productiveness purposes to hide malware-like capabilities behind absolutely functioning doc converters, meal planners, recipe instruments, and PDF utilities. <\/p>\n
The purposes ship their marketed options, however their shared codebase additionally allows runtime JavaScript execution and entry to desktop-capture performance making a severe surveillance and post-compromise threat.<\/p>\n
Search-optimized web sites and convincing obtain pages could make undesirable purposes seem respectable, notably after they supply frequent capabilities comparable to PDF conversion or doc modifying. <\/p>\n
Comparable ways have been noticed within the TamperedChef marketing campaign<\/a>, the place malicious PDF-editor software program was promoted by fraudulent web sites and operated as a backdoor beneath a decoy interface.<\/p>\n Researchers recognized a cluster of associated Electron purposes, together with Kitchen Canvas, Meals or Meal Method, DocConvertWizard, and several other PDF conversion utilities. <\/p>\n Regardless of differing names and claimed functions, the samples shared near-identical Electron framework parts, together with primary.js and preload.js, indicating that they seemingly originated from a standard improvement framework or marketing campaign infrastructure.<\/p>\n Projextor is distributed by web sites promoting doc conversion, recipe administration, and meal-planning purposes. <\/p>\n One noticed area, doceditorinc[.]com, seems designed to impersonate the respectable on-line document-processing service doceditor[.]in. <\/p>\n Such lookalike infrastructure may be particularly efficient when paired with search-engine visibility, as a result of victims could obtain the applying after looking for a routine software program utility.<\/p>\n The primary-stage installers range in format, with samples packaged utilizing NSIS, Squirrel Installer, and Inno Setup. No matter packaging, every acts as a downloader for a second-stage Electron utility. <\/p>\n The downloaded Electron package deal contained the important thing primary.js and preload.js parts liable for the applying\u2019s privileged habits.<\/p>\n Electron combines Chromium and Node.js, permitting purposes constructed with HTML, CSS, and JavaScript to entry native desktop sources. <\/p>\n G Knowledge Researchers stated that<\/a>, the marketing campaign displays a rising sample of abuse by which attackers exploit customers\u2019 belief in free productiveness software program. Its preload-script mechanism is meant to bridge browser-renderer content material with privileged Node.js performance selectively. <\/p>\n Electron recommends isolating that bridge, as a result of context isolation prevents loaded net content material from immediately accessing Electron internals and privileged APIs.<\/p>\n Projextor\u2019s code as a substitute explicitly makes use of contextIsolation: false. It is a notable crimson flag: context isolation has been enabled by default since Electron 12 and is a core safety suggestion for purposes that load net content material. <\/p>\n Disabling it will probably enable renderer-side content material to work together with APIs uncovered by the preload layer, considerably increasing the influence of compromised or attacker-controlled net content material.<\/p>\n The appliance additionally suppresses legacy-build warnings by disableOldBuildWarning, apparently stopping customers from being alerted to outdated and doubtlessly insecure Electron variations. <\/p>\n Extra importantly, the preload layer can find and execute JavaScript modules from a devoted injection listing. <\/p>\n This creates a modular execution mechanism by which operators may introduce new performance after set up with out changing the primary utility binary.<\/p>\n Projextor moreover implements a customized screen-share picker that enumerates accessible desktops and utility home windows, shows thumbnails, and selects a seize supply by Electron IPC communication. <\/p>\n![\"Projextor](\"https:\/\/blog.gdatasoftware.com\/fileadmin\/web\/general\/images\/blog\/2026\/08\/Figure1_Website.png\")
Projextor\u2019s An infection Method<\/strong><\/h2>\n
![\"Projextor](\"https:\/\/blog.gdatasoftware.com\/fileadmin\/web\/general\/images\/blog\/2026\/08\/Figure3_Projextor_Infection_Chain.png\")