HotPage: Story of a signed, vulnerable, ad-injecting driver

ESET Research analyzes HotPage (DwAdsafe), an ad-injecting installer that deploys a Microsoft-signed kernel driver and browser-hooking libraries to intercept and modify browser network traffic, inject ads, change homepages, and exfiltrate basic system information; the driver’s improper access controls allow arbitrary processes to misuse its injection capabilities and enable local privilege escalation to SYSTEM. The report includes technical details of the installer, driver, injected libraries, redirection methods, proof-of-concept escalation scenarios, IoCs (hashes, IPs, domains), and mitigation context (driver removal from the Windows Server Catalog).