Security Magic

UFile | Search Hijacker — Technical Analysis Malware research / technical case study UFile: Signed PDF Utility Delivering an In-Memory Chrome Search Hijacker A .NET installer distributed through an advertising redirect downloads a functional PDF utility, retrieves an encrypted .NET stage, and modifies Chrome search-provider configuration to use an operator-supplied search destination. Search hijacking reproduced Analysis: October 30, 2026 Platform: Windows / Google Chrome Evidence: PE, Authenticode, dnSpy exports, Fiddler SAZ, Frida, controlled rerun Executive summary Distribution Execution chain Chrome modification Indicators Assessment Executive summary Classification: Browser/search hijacker delivered through a signed PDF utility installation chain. The original executable is signed by FAIRLIE LIMITED. Its first-stage installer obtains an application ZIP from alyclick.com ; the installed application requests an encrypted second-stage payload from api.catchasail.com , decrypts ...

CookUp: Suspicious Server-Gated Installer and Loader Analysis Malware Research / Technical Analysis Inside CookUp: A Suspicious Server-Gated Installer and In-Memory Loader CookUp is a recipe application distributed by an installer that also contains a suspicious, server-controlled remote-loading workflow. The installer drops/installs cookup.exe, a .NET recipe application with a limited JSON-based recipe database; in the observed installation, that application appeared functional and benign. The separate Go-based installer can activate a downloader and contains code for processing and loading native PE modules. No authentic second-stage payload was recovered, and malicious activity has not been established. Research date: October 29, 2026 · Platform: Windows 11 FLARE-VM · Architecture: 32-bit Go installer · Evidence: Ghidra, Frida 17.7.3, localhost HTTPS sinkhole · Updated October 29, 2026 with Frida V7 and Fiddler/Retrohunt follow-up Downloader Server-side activation Manual PE mappi...

Microsoft App Store publisher continues hosting undisclosed proxyware: StoreSocks proxyware campaign analysis and updates. I've observed some new stores and updated campaign behavior related to what I wrote about in Part 1 . Some changes include the Store publisher names, DLL file names, and a move from koffi to ffi-rs for the loading of the Go based proxyware binary. A detailed writeup on some of the new behaviors can be seen from HexaStrike who has named this campaign StoreSocks . I kind of like the name. Anyway, I don't intend this to be a long post, just some quick updates and observations on the campaign. New Publisher Names TECHNOLOGIES FOR BUSINESS LLC SOFTWARE MATTERS LLC New DLL file names: telemetry.dll /lib[A-Z0-9]{3}\.dll/ New C2: gate1.storetelemetryapiapps.xyz telemetrystoreapi1.xyz storetelemetryapi.xyz Additional Reading on recent Proxyware News: Nearly half of Smart TVs with Proxyware FBI Seizes NetNut Proxy Platform, Popa Botnet STORESOCKS – Microsoft Sto...