Hackers Exploit Legitimate Websites to Deliver BadSpace Windows Backdoor

Legitimate-but-compromised websites (including WordPress sites) are being used to deliver a Windows backdoor named BadSpace by overlaying pages with fake Google Chrome update pop-ups which drop either the backdoor or a JScript downloader; the multi-stage chain collects device and visitor data, contacts hard-coded C2 domains, and then deploys BadSpace which implements anti-sandbox checks, scheduled-task persistence, information harvesting, remote command execution (screenshots, cmd.exe execution, file read/write), and can remove its scheduled task. Analysis links the campaign to the JavaScript-based SocGholish/FakeUpdates ecosystem, and multiple security vendors have reported similar fake-update lures in active distribution campaigns.