Projextor + TamperedChef: Electron-Based Trojanized Productivity Apps Distributed via SEO Poisoning — OTX Detection Pack | Security Arsenal

Threat Summary

A live AlienVault OTX pulse (TLP:WHITE, 2026-08-18) documents the Projextor campaign — a malware distribution operation that weaponizes the Electron framework to deliver trojanized productivity applications. The campaign pairs Projextor with the TamperedChef malware family and relies on a deceptively effective social engineering model: fully functional applications that do exactly what they advertise.

The attack chain is as follows:

Lure: Threat operators register impersonation domains (e.g., pdfgrip.com, flipformatpdf.com, kitchen-canvas.com) that mimic legitimate document converters, PDF managers, and meal-planning services.
Distribution: These sites are boosted via SEO poisoning / high-ranking search results, meaning victims self-select — they search for a free PDF tool and install the malware themselves, bypassing many email-centric controls.
Execution: The downloaded application is a legitimate-looking Electron app with a working UI. Embedded within the Electron package (typically app.asar or unpacked JavaScript resources) is malicious JavaScript execution logic tied to the TamperedChef payload.
Objective: Observed capabilities include desktop capture (screen collection), staging for follow-on payloads, and establishing a foothold for espionage or downstream monetization. The attribution is currently unknown, but the tradecraft — functional decoy apps, infrastructure mimicry, and search-engine abuse — is consistent with financially motivated access operations that often resell initial access into larger intrusion ecosystems, including dark web initial access broker (IAB) markets.

The collective signal from this pulse: attackers are industrializing trojanized freeware. Because the apps genuinely work, users rarely report them, and signature-based AV struggles since Electron apps legitimately execute JavaScript, spawn Node.js runtimes, and make network calls.

Threat Actor / Malware Profile

Families: Projextor (campaign/loader), TamperedChef (payload) Attribution: Unknown (as of pulse publication) Primary vector: Trojanized Electron-based desktop applications distributed through impersonation websites ranking highly in search results

Distribution Method

Impersonation websites posing as PDF converters, document tools, and lifestyle/productivity utilities
SEO manipulation to surface malicious sites in top organic search results
Direct download installers (no exploit required — user-driven install)

Payload Behavior

Malicious JavaScript embedded inside Electron application resources (app.asar, resources/app/, or injected into renderer/main process scripts)
Functional decoy UI performing the advertised task (document conversion, meal planning) to reduce suspicion
Desktop capture / screenshot collection consistent with surveillance and data staging
Secondary payload retrieval and staging capability

C2 Communication

HTTPS to attacker-controlled infrastructure, often blending with legitimate Electron app telemetry/update traffic
Infrastructure hosted on lookalike domains distinct from the lure sites

Persistence Mechanism

Standard application persistence: Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run), Start Menu/Startup folder shortcuts, and auto-launch entries registered during installer execution
Electron auto-updater channels can be abused to maintain or refresh the implant

Anti-Analysis Techniques

Legitimate application functionality masks malicious behavior from sandbox dynamic analysis
Malicious JS packed inside app.asar archives, evading static scanners that do not unpack Electron bundles
Code staged or fetched post-install to keep the initial installer hash reputation clean

IOC Analysis

The pulse contains 29 indicators across three types:

Type	Examples	Operationalization
Domains	`pdfgrip.com`	Block at DNS resolver, secure web gateway, and EDR network controls. Add to threat intel platform with pulse context.
URLs	`https://flipformatpdf.com/`, `https://kitchen-canvas.com/`, `https://pdfgrip.com/`	Proxy/SWG category override to block; retro-search proxy logs for 90 days to identify hosts that visited lure sites.
File hashes (MD5/SHA1/SHA256)	`3c1dbc3f56e91cc79f0014850e773a7f12bbfef06680f08f883b2bf12873eccc`, `d749e0f8f2cd4e14178a787571534121`, `04cc663812883562b762d184266e1457e98b7de8`, `415a96f247ec0477080f576a4b91f7a1`	Load into EDR block lists and custom detection rules. Note: hashes rotate quickly with repackaged installers — pair with behavioral detection below.

Tooling to decode/enrich:

Electron ASAR extraction: npx asar extract app.asar out/ or 7-Zip to inspect embedded JavaScript for obfuscated payloads and C2 URLs
Hash reputation: VirusTotal / OTX pulsing on SHA256 values for sibling samples
DNS pivoting: Passive DNS (SecurityTrails, Validin) on pdfgrip.com to enumerate sibling lure infrastructure on shared registrars/nameservers
Sandboxing: Any.Run / Joe Sandbox with network capture to surface C2 not present in static IOCs

SOC guidance: Hash-based blocking is necessary but insufficient for this campaign. Prioritize the behavioral detections below — Electron apps spawning unusual child processes, unsigned binaries in user-writable paths making outbound connections, and app.asar writes outside sanctioned software deployment.

Detection Engineering

YAML

---
title: Projextor - Trojanized Electron Application Network Beaconing
id: 7f3a1c2e-9b4d-4e6a-8c1f-2d5e7a9b0c11
status: experimental
description: Detects Electron-based applications installed in user-writable paths making outbound network connections, consistent with Projextor/TamperedChef trojanized productivity apps (pdfgrip, flipformatpdf, kitchen-canvas lures).
author: Security Arsenal Threat Intel
references:
  - https://blog.gdatasoftware.com/2026/08/38468-projextor-abusing-electron
date: 2026/08/18
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|contains:
      - '\AppData\Local\Programs\'
      - '\AppData\Roaming\'
      - '\Downloads\'
  selection_electron:
    Image|contains:
      - 'resources\app'
    Description|contains:
      - 'Electron'
  filter_legit:
    Image|contains:
      - '\slack\'
      - '\Microsoft Teams\'
      - '\discord\'
      - '\spotify\'
      - '\vscode\'
      - '\signal\'
      - '\obsidian\'
  condition: (selection_image or selection_electron) and not filter_legit
falsepositives:
  - Legitimate niche Electron applications installed by users
level: medium
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1204.002
---
title: Projextor - Electron Child Process Spawning Script or Capture Tooling
id: 8a4b2d3f-0c5e-5f7b-9d2a-3e6f8b0c1d22
status: experimental
description: Detects Electron renderer/main processes spawning scripting engines, shells, or screen capture utilities — consistent with TamperedChef JavaScript execution and desktop capture behavior inside trojanized apps.
author: Security Arsenal Threat Intel
references:
  - https://blog.gdatasoftware.com/2026/08/38468-projextor-abusing-electron
date: 2026/08/18
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\AppData\Local\Programs\'
      - '\AppData\Roaming\'
  selection_parent_name:
    ParentImage|endswith: '.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\node.exe'
      - '\python.exe'
  filter_legit:
    ParentImage|contains:
      - '\slack\'
      - '\Microsoft Teams\'
      - '\discord\'
      - '\vscode\'
  condition: selection_parent and selection_parent_name and selection_child and not filter_legit
falsepositives:
  - Developer tooling and legitimate Electron apps with shell integrations
level: high
tags:
  - attack.execution
  - attack.t1059.007
  - attack.t1113
---
title: Projextor - Persistence via Run Key from User-Installed Electron App
id: 9c5d3e4a-1d6f-6a8c-0e3b-4f7a9c1e2f33
status: experimental
description: Detects registry Run key persistence entries pointing to executables in user-writable paths, matching Projextor trojanized productivity app persistence after installer execution.
author: Security Arsenal Threat Intel
references:
  - https://blog.gdatasoftware.com/2026/08/38468-projextor-abusing-electron
date: 2026/08/18
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\CurrentVersion\Run'
      - '\CurrentVersion\RunOnce'
  selection_value:
    Details|contains:
      - '\AppData\Local\Programs\'
      - '\AppData\Roaming\'
      - 'pdfgrip'
      - 'flipformat'
      - 'kitchen-canvas'
  filter_legit:
    Details|contains:
      - 'OneDrive'
      - 'Teams'
      - 'Slack'
  condition: selection_key and selection_value and not filter_legit
falsepositives:
  - Legitimate user-installed auto-updating applications
level: medium
tags:
  - attack.persistence
  - attack.t1547.001

KQL — Microsoft Sentinel / Defender

// Projextor / TamperedChef hunt: lure-site visits, Electron process anomalies, and IOC hash matches
let ProjextorIOCs = dynamic(["pdfgrip.com","flipformatpdf.com","kitchen-canvas.com"]);
let ProjextorHashes = dynamic([
  "3c1dbc3f56e91cc79f0014850e773a7f12bbfef06680f08f883b2bf12873eccc",
  "d749e0f8f2cd4e14178a787571534121",
  "04cc663812883562b762d184266e1457e98b7de8",
  "415a96f247ec0477080f576a4b91f7a1"
]);
// 1) Network connections to lure infrastructure
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has_any (ProjextorIOCs)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteUrl, RemoteIP, ActionType
| extend Detection = "Lure/C2 Domain Contact"
// 2) File hash matches on trojanized installers
| union (
    DeviceFileEvents
    | where TimeGenerated > ago(30d)
    | where SHA256 in~ (ProjextorHashes) or MD5 in~ (ProjextorHashes) or SHA1 in~ (ProjextorHashes)
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, MD5, ActionType
    | extend Detection = "Known Malicious Hash"
)
// 3) Unsigned Electron-style apps in user paths spawning script engines (TamperedChef JS execution / desktop capture)
| union (
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFolderPath has_any (@"\AppData\Local\Programs\", @"\AppData\Roaming\")
    | where FileName in~ ("powershell.exe","cmd.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","node.exe")
    | where InitiatingProcessFileName !in~ ("slack.exe","teams.exe","ms-teams.exe","discord.exe","code.exe","spotify.exe","obsidian.exe","signal.exe")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, FileName, ProcessCommandLine, AccountName
    | extend Detection = "Electron Child Scripting Engine"
)
| sort by TimeGenerated desc

PowerShell

# Projextor / TamperedChef endpoint IOC hunt — run via EDR live response or PS remoting
# Checks Run keys, Startup folder, Electron app directories, and active connections to lure domains

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

$LureDomains   = @('pdfgrip.com','flipformatpdf.com','kitchen-canvas.com')
$MalHashes     = @('3c1dbc3f56e91cc79f0014850e773a7f12bbfef06680f08f883b2bf12873eccc',
                   'd749e0f8f2cd4e14178a787571534121',
                   '04cc663812883562b762d184266e1457e98b7de8',
                   '415a96f247ec0477080f576a4b91f7a1')
$SuspiciousNames = @('pdfgrip','flipformat','kitchen-canvas','kitchencanvas','pdf-grip')

Write-Host "=== [1/5] Run Key Persistence (HKCU/HKLM) ==="
$runPaths = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
              'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce',
              'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
              'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run')
foreach ($rp in $runPaths) {
    Get-ItemProperty -Path $rp | ForEach-Object {
        $_.PSObject.Properties | Where-Object {
            $_.Value -match 'AppData\\(Local\\Programs|Roaming)' -and
            $_.Value -notmatch 'OneDrive|Teams|Slack|Spotify|Discord'
        } | ForEach-Object {
            $report += [pscustomobject]@{Check='RunKey'; Location=$rp; Name=$_.Name; Value=$_.Value}
            Write-Host "  [HIT] $($_.Name) -> $($_.Value)" -ForegroundColor Red
        }
    }
}

Write-Host "=== [2/5] Startup Folder Shortcuts ==="
$startupDirs = @("$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup",
                 "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup")
foreach ($sd in $startupDirs) {
    Get-ChildItem $sd -Filter *.lnk | ForEach-Object {
        $sh = New-Object -ComObject WScript.Shell
        $target = $sh.CreateShortcut($_.FullName).TargetPath
        if ($SuspiciousNames | Where-Object { $target -match $_ }) {
            $report += [pscustomobject]@{Check='StartupLnk'; Location=$_.FullName; Name=$_.Name; Value=$target}
            Write-Host "  [HIT] $($_.FullName) -> $target" -ForegroundColor Red
        }
    }
}

Write-Host "=== [3/5] Suspicious Electron App Directories ==="
$appDirs = @("$env:LOCALAPPDATA\Programs", "$env:APPDATA")
foreach ($ad in $appDirs) {
    Get-ChildItem $ad -Directory | Where-Object {
        $n = $_.Name.ToLower(); ($SuspiciousNames | Where-Object { $n -match $_ })
    } | ForEach-Object {
        $asar = Join-Path $_.FullName 'resources\app.asar'
        $report += [pscustomobject]@{Check='ElectronApp'; Location=$_.FullName; Name=$_.Name; Value=(Test-Path $asar ? 'app.asar present' : 'unpacked')}
        Write-Host "  [HIT] $($_.FullName)" -ForegroundColor Red
    }
}

Write-Host "=== [4/5] Hash Sweep of Recently Downloaded Executables ==="
Get-ChildItem "$env:USERPROFILE\Downloads" -Recurse -Include *.exe,*.msi -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-45) } | ForEach-Object {
        $h256 = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
        $hmd5 = (Get-FileHash $_.FullName -Algorithm MD5).Hash.ToLower()
        if ($MalHashes -contains $h256 -or $MalHashes -contains $hmd5) {
            $report += [pscustomobject]@{Check='MalHash'; Location=$_.FullName; Name=$_.Name; Value=$h256}
            Write-Host "  [CRITICAL HIT] $($_.FullName) SHA256=$h256" -ForegroundColor Red
        }
    }

Write-Host "=== [5/5] Active/Recent Connections to Lure Infrastructure ==="
$ips = @()
foreach ($d in $LureDomains) { $ips += (Resolve-DnsName $d -Type A).IPAddress }
Get-NetTCPConnection -State Established | Where-Object { $ips -contains $_.RemoteAddress } | ForEach-Object {
    $proc = (Get-Process -Id $_.OwningProcess).Path
    $report += [pscustomobject]@{Check='LiveC2'; Location=$_.RemoteAddress; Name='EstablishedConn'; Value=$proc}
    Write-Host "  [CRITICAL HIT] $($_.RemoteAddress):$($_.RemotePort) <- $proc" -ForegroundColor Red
}

Write-Host "`n=== Hunt complete: $($report.Count) findings ==="
$report | Export-Csv -Path "$env:TEMP\projextor_hunt_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation
$report | Format-Table -AutoSize

Response Priorities

Immediate (0–4 hours)

Block pdfgrip.com, flipformatpdf.com, kitchen-canvas.com at DNS, secure web gateway, and EDR network layers; sinkhole where possible for victim identification
Push the four pulse file hashes into EDR block/deny lists and email/web filtering
Run the KQL hunt across the fleet for the past 30 days; retro-search proxy and DNS logs for lure domain visits
Isolate any host with a hash match or confirmed execution of the trojanized installer

24 Hours

For any confirmed victim host: treat as potentially compromised credentials and session data — Projextor-class implants with desktop capture frequently precede credential theft; force password resets and revoke active sessions/tokens for affected users
Collect memory and the installed Electron package (resources\app.asar) from affected hosts; extract with ASAR tooling to identify embedded C2 URLs not present in the public IOC set
Review browser history/downloads on victim machines to determine the exact search query and lure page used — this informs both scoping and user-awareness follow-up
Check for lateral movement artifacts from affected hosts (SMB, RDP, WinRM) given unknown-dwell implant activity

1 Week

Application control hardening: Deploy WDAC or AppLocker policies restricting execution of unsigned/unapproved binaries from %LOCALAPPDATA%\Programs and %APPDATA% — the canonical install path for trojanized Electron apps
Stand up the Sigma rules above in production with a tuned allowlist for sanctioned Electron apps (Teams, Slack, VS Code)
Implement an approved-software catalog and block user self-installation of PDF/productivity freeware; provide sanctioned alternatives to remove the search-driven lure
Add SEO-poisoning awareness to user training: "top search result ≠ trusted source" for downloadable utilities
Enrich the threat intel platform with the pulse IOCs and schedule passive-DNS pivoting to catch successor lure domains registered on shared infrastructure

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

Projextor + TamperedChef: Electron-Based Trojanized Productivity Apps Distributed via SEO Poisoning — OTX Detection Pack