Software Productivity Tools Hijacked to Deliver Infostealers

Conceptworld Corporation inadvertently distributed trojanized installers for Notezilla, RecentX, and Copywhiz in June; security researchers from Rapid7 found that the installers contained a low-sophistication infostealer dubbed "dllFake" that captures browser data, cryptocurrency wallet information, keystrokes, and clipboard contents and can fetch additional payloads. Rapid7 notified the vendor on June 24 and the company removed the malicious installers and replaced them with legitimate, signed copies within 12 hours; the intrusion appears to have been achieved by swapping files on the vendor's download server (potential web-server vulnerability), and users are advised to validate file signatures and hashes.