Hackers Using PUP Advertisements to Silently Drop Windows Malware

Researchers uncovered a widespread campaign delivering a stealthy Windows malware called ManualFinder via PUP-style ads that redirect users to spoofed installers. The attack chain uses MSHTA-executed JavaScript loaders and quiet MSI installs to establish persistence (scheduled tasks and services), recruit infected hosts into residential proxy networks, and in some instances harvest browser cookies and manipulate profiles for data exfiltration or monetization; investigators observed over 70 JavaScript variants and identified malicious domains and task/installer IOCs.