Alert: HotPage Adware Disguised as Ad Blocker Installs Malicious Kernel Driver

ESET researchers uncovered 'HotPage', an adware installer that deploys a Microsoft-signed kernel driver and libraries to intercept browser traffic, modify pages, display ads, and exfiltrate system information. The driver can inject code into remote processes and, due to missing access controls, allows non-privileged accounts to escalate to NT AUTHORITY\System; the driver was linked to a Chinese company and removed from the Windows Server Catalog in May 2024.