Stealthy Ad-Based Malware Campaign Targets Windows Users via PUPs

Researchers at Expel uncovered an ad-driven malware campaign in which apparently legitimate productivity apps (e.g., ManualFinder, OneStart, AppSuite-PDF, PDF Editor) are distributed via deceptive landing pages and bundled MSI installers that silently deploy trojans. The malware achieves persistence through scheduled tasks and Node.js-executed JavaScript droppers in %TEMP%, abuses code-signing certificates from questionable entities, connects to known malicious domains (mka3e8.com), and in some cases converts victim machines into residential proxies; the report provides IoCs and hunting/mitigation guidance.