Free Converter Apps that Convert your Clean System to Infected in Seconds

Malicious file-converter apps promoted through deceptive Google ads are delivering trojanized C# converters that install persistent RATs on victim systems. The campaign uses redirects through multiple domains to fake converter sites, abuses code-signing certificates to appear legitimate, drops payloads into %LocalAppData%, creates scheduled tasks (often with a +1 day execution offset), and communicates with attacker-controlled C2 servers to run additional .NET assemblies; the report includes numerous payload delivery domains and detection/mitigation guidance.