Attackers Are Weaponizing Foxit PDF Reader’s Reputation

G DATA warns of a global social-engineering campaign that impersonates Foxit installer files to execute malicious EXEs which deploy an MSI that silently installs UltraVNC. The dropper uses decoy content (a Danish passport image), hides components under C:\intel-GPU, creates firewall exceptions and persistence via gpu.txt, SilentRun.vbs, gpu.cmd and gpu.exe, providing attackers full remote access and file exfiltration; detections appeared in Germany, the US, the UK and Ukraine.