From PDFs to Payload: Bogus Adobe Acrobat Reader Installers Distribute Byakugan Malware

Fortinet and AhnLab disclosures describe a campaign delivering a node.js-based multi-functional malware called Byakugan via fake Adobe Acrobat Reader installers in Portuguese; the dropper uses DLL hijacking and UAC bypass to load a malicious DLL that fetches the main payload. Byakugan is reported to establish persistence, monitor desktops (using OBS), capture screenshots, log keystrokes, enumerate and exfiltrate files, and download cryptocurrency miners; the report also highlights concurrent campaigns distributing the Rhadamanthys infostealer and the WikiLoader/WailingCrab malware via manipulated installers and fake sites.