DigitalPulse Proxyware Being Distributed Through Ad Pages

AhnLab ASEC describes an active proxyjacking campaign distributing DigitalPulse proxyware via ad/pop-up pages on freeware sites: users downloading a YouTube-downloader-type executable are redirected to malicious ads that install a disguised downloader (AutoClicker) which uses anti-VM/sandbox checks, deploys a PowerShell downloader and NodeJS-executed JavaScript, then fetches and installs proxyware (signed with a Netlink Connect certificate) and persists via scheduled tasks; the report includes behavior detections, file hashes and URLs as IOCs and warns users to avoid ad/pop-up installers and to use V3 products.