Projextor Malware Disguises Malicious Code Within Legitimate-Looking Electron Apps
The Projextor malware campaign is distributing malicious code hidden within seemingly functional desktop applications like document converters and meal planners, leveraging Electron's architecture to gain broad system access.
A new malware campaign, dubbed Projextor, has emerged, cleverly disguising malicious code within seemingly legitimate desktop applications. Operators are distributing these applications, which include document converters, meal planners, and recipe apps, through lookalike download sites. These applications are designed to appear fully functional, ensuring that users receive a program that performs its advertised task from the moment it is launched.
Security researchers at G Data identified a cluster of these applications that share a common hidden framework. While the applications perform their intended functions, they conceal code that possesses significantly broader system access than a user would expect. This duality—a functional interface paired with hidden malicious capabilities—raises the stakes for both individuals and organizations, as the apparent trustworthiness of the tool masks its underlying danger.
The Projextor campaign specifically abuses the architecture of the Electron framework, a popular choice for building desktop applications using web technologies. Electron allows applications to interact with operating system functions, a capability that Projextor exploits. The malware achieves this by placing its core malicious files, main.js and preload.js, within the application's resources directory, ensuring they execute automatically upon program startup.
A critical step in Projextor's operation involves disabling Electron's default context isolation. This security safeguard, enabled by modern versions of Electron, normally prevents loaded content from accessing sensitive system functions. By disabling it, Projextor allows the application's code to gain access to Node.js capabilities, effectively opening a backdoor for malicious activities.
Furthermore, Projextor is designed to load and execute arbitrary JavaScript modules from a dedicated injection directory. This modular approach makes the initial download a flexible base for various payloads, rather than a fixed, single-purpose piece of malware. This technique is reminiscent of previous Electron framework malware campaigns that leveraged the framework's access to local resources for data theft.
The campaign also includes a custom screen-sharing picker, which lists available monitors and application windows with thumbnail previews. While screen capture itself is not inherently malicious, its inclusion in productivity tools, coupled with the ability to execute arbitrary scripts, presents a significant risk. This feature could allow attackers to monitor active work, capture sensitive documents displayed on screen, and observe user sign-in workflows, potentially revealing information visible only during live sessions.
The shared main.js and preload.js design across multiple applications suggests a common campaign or codebase, although researchers have not definitively attributed all affected applications to the same threat actor. The practical implications for users are clear: download software exclusively from verified sources, confirm the publisher's legitimacy, and exercise extreme caution with sites that mimic established services. Security teams should also review newly installed Electron applications for unexpected scripts and insecure configurations.
To mitigate risks, organizations should enforce strict software installation policies, educate users about the dangers of downloading from untrusted sources, and implement network monitoring to detect suspicious outbound connections or unauthorized script execution. The Projextor campaign serves as a stark reminder that even seemingly innocuous productivity tools can harbor significant security threats.