Security researchers have uncovered a sophisticated malware campaign spanning seven years, where threat actors behind AppSuite-PDF and PDF Editor applications systematically abused code-signing certificates to legitimize their malicious software.

The actors, tracked under the malware family name BaoLoader, have utilized at least 26 code-signing certificates obtained through fraudulent business registrations, primarily targeting users seeking PDF editing tools and productivity applications.

The campaign demonstrates a calculated approach to certificate authority manipulation, with threat actors establishing legitimate businesses across multiple jurisdictions including Panama, Malaysia, and the United States.

These entities served as fronts for obtaining code-signing certificates from major certificate authorities including SSL.com, GlobalSign, DigiCert, and Sectigo.

The malware has been distributed under various guises, including AppSuite-PDF, PDF Editor, ManualFinder, PDFTools, PDFProSuite, and OneStart, often masquerading as potentially unwanted programs (PUPs) while harboring backdoor capabilities.

What sets this campaign apart from typical certificate abuse scenarios is the actors’ consistent pattern of obtaining multiple certificates for identical company names from different certificate authorities.

Expel researchers identified this unusual behavior while analyzing the CertCentral.org database, noting that among over 1,500 documented organizations with abused certificates, these actors were unique in their geographic certificate patterns and systematic approach to legitimacy simulation.

The threat actors’ methodology extends beyond simple certificate procurement to include sophisticated distribution mechanisms.

Files have been uploaded to platforms like VirusTotal under numerous deceptive names, with single executables appearing as “ZoomSetup,” “WinRarSetup,” “MinecraftSetup,” and various PDF-related applications.

This multi-naming strategy indicates deliberate attempts to maximize infection vectors by appealing to diverse user interests and needs.

Certificate Authority Exploitation and Business Registration Patterns

The technical infrastructure behind BaoLoader reveals meticulous planning in certificate acquisition strategies.

The actors established companies with media-focused naming conventions, including GLINT SOFTWARE SDN. BHD., ECHO INFINI SDN. BHD., Summit Nexus Holdings LLC, Apollo Technologies Inc., and Caerus Media LLC.

Each entity was registered with legitimate business documentation, enabling the actors to pass initial certificate authority verification processes.

Analysis of the certificate metadata reveals consistent business serial numbers across multiple certificate authorities for identical company names.

For instance, Eclipse Media Inc. certificates were issued by GlobalSign, SSL.com, Sectigo, and DigiCert, all containing matching business registration identifiers.

This approach allowed the actors to maintain operational continuity when individual certificates faced revocation, seamlessly transitioning between certificate authorities while maintaining the same organizational identity.

The malware’s persistence mechanisms include PowerShell execution designed to load Web Companion components, executing commands that bypass execution policies and load assemblies from encrypted files.

The campaign’s evolution from simple adware distribution to backdoor deployment represents a concerning escalation in threat actor capabilities, demonstrating how certificate abuse can provide extended operational longevity for malicious campaigns targeting productivity software users.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Actors Behind AppSuite-PDF and PDF Editor Used 26 Code-Signing Certificates to Make Software Appear Legitimate appeared first on Cyber Security News.

DarkCloud Stealer has recently emerged as a potent threat targeting financial organizations through convincing phishing campaigns. Adversaries employ weaponized RAR attachments masquerading as legitimate documents to deliver a multi-stage JavaScript-based payload.

Upon opening the archive, victims execute a VBE script that leverages Windows Script Host to initiate a PowerShell downloader hidden in innocuous-seeming image files.

This initial access vector exploits users’ trust in routine financial correspondence, triggering an automated chain of decoding and decryption steps designed to evade conventional security controls.

In early September 2025, security teams observed a dramatic uptick in malicious RAR attachments sent to corporate email accounts within the banking sector.

CyberProof analysts identified that the archive named “Proof of Payment.rar” contains a VBE script which, when executed, calls PowerShell to download an embedded JPG file named universe-1733359315202-8750.jpg.

The stealer’s loader is concealed within this image, and the decoding routine extracts the .NET DLL module directly from image pixel data.

CyberProof researchers noted that the PowerShell script rigorously checks memory offsets to locate a distinct BMP header pattern before carving out the loader DLL.

The following snippet illustrates the core loop used for scanning the downloaded image bytes:-

for ($i=0; $i -lt $data.Length - $header. Length; $i++) {
    $match = $true
    for ($j=0; $j -lt $header.Length; $j++) {
        if ($data[$i + $j] -ne $header[$j]) { $match = $false; break }
    }
    if ($match) { $offset = $i; break }
}

Once the DLL is reconstructed in memory, the script invokes [Reflection.Assembly]::Load() to execute the loader without ever touching disk.

Persistence and Credential Theft

After loading into memory, DarkCloud Stealer establishes persistence by copying a JavaScript payload to the Windows Run registry key under a disguised filename (M3hd0pf.exe masquerading as MSBuild.exe), ensuring execution on every user login.

The stealer then injects into legitimate processes like MSBuild.exe and mtstocom.exe using process hollowing techniques, enabling it to siphon saved credentials from browser databases such as Chrome’s Login Data.

Alerts from endpoint detection platforms confirm DPAPI access events and memory mapping into browser processes, revealing attempts to decrypt stored passwords directly in memory.

Finally, stolen data is staged in user directories and exfiltrated via FTP and HTTP channels to dynamic domain clusters (.shop, .xyz), complicating network-based detection.

Financial institutions are urged to monitor for anomalous VBE/VBS execution, unexpected registry Run key modifications, and JavaScript files in public download folders to rapidly detect and disrupt this insidious campaign.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post DarkCloud Stealer Attacking Financial Companies With Weaponized RAR Attachments appeared first on Cyber Security News.