The malicious websites, including domains such as candyxpdf[.]com and candyconverterpdf[.]com, deploy an elaborate social engineering tactic designed to harvest sensitive information from unsuspecting users seeking to convert document formats. The malware accesses the machine GUID, computer name, and checks supported languages before proceeding to harvest sensitive data including stored passwords and cryptocurrency wallet credentials. The impact of this attack is severe, as the malware is specifically designed to harvest browser credentials, cryptocurrency wallet information, and other sensitive data from compromised systems. Users are advised to employ only trusted file conversion tools from official sources and to remain vigilant about any website requesting command-line execution, regardless of how legitimate the interface appears. Cybercriminals have launched a sophisticated malware campaign leveraging fake PDF-to-DOCX converter websites that mimic the popular legitimate service PDFCandy. The infection demonstrates advanced evasion techniques, including the abuse of legitimate Windows utilities to bypass security controls. This encoded command initiates a web request to download the “adobe.zip” archive, which contains multiple files including the malicious “audiobit[.]exe” executable. When executed, this file launches a legitimate Windows utility, MSBuild.exe, to load the ArechClient2 malware through a technique known as living-off-the-land. When users attempt to convert documents on these fraudulent platforms, they’re presented with a seemingly legitimate interface complete with animated loading sequences and familiar conversion options. The malware performs multiple suspicious actions including registry queries, system information discovery, and credential hunting. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. This command, when executed, initiates a sophisticated infection chain that ultimately deploys the ArechClient2 information stealer.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 16 Apr 2025 19:20:14 +0000