Do Son 
Projextor Productivity Application Website
At a glance
| Malware family | Projextor (Electron-based) |
| Threat actor | Unknown; shared code base, no confirmed single operator |
| Targets | Users seeking free productivity tools |
| Delivery vector | Fake PDF converters, meal planners, and recipe apps on lookalike sites |
| Key capabilities | Runtime script injection, desktop screen capture |
| Source | G DATA |
TL;DR
G DATA found a malware family it names Projextor hidden inside working productivity apps. The apps convert PDFs or plan meals, yet they also run injected scripts and capture the screen. Lookalike websites deliver them to users hunting free tools.
Delivery
The Projextor malware spreads through fake download sites. These pages advertise document converters, meal planners, and recipe tools. One domain, doceditorinc[.]com, imitates a real service at doceditor[.]in. As G DATA notes, free productivity tools make it easy for Projextor “to spread, as users often trust and download these applications without verifying where they came from.”
This tactic echoes an earlier campaign called TamperedChef. In both cases, attackers used high-ranking search results to push a deceptive tool. The lure looks useful, so victims install it without a second thought.
Infection chain
The attack starts with a first-stage installer or downloader. Some samples use NSIS, while others use Squirrel or Inno Setup. Whatever the format, the goal stays the same. It fetches a second-stage Electron application.
That second stage is the real productivity app. It ships with two key files, main.js and preload.js. Together they form the entry point for loading extra JavaScript.
Insecure by design
The developers weakened the app on purpose. They set contextIsolation to false, which lets a remote page reach the system through Node.js. They also silenced outdated-build warnings. Code comments confirm these choices were deliberate.
Capabilities and data risk
Projextor’s worst trait is runtime script injection. The app scans a dedicated folder and runs any JavaScript it finds. As a result, an operator can add new functions after install. No update to the original code is needed.
The app also builds in desktop capture. It enumerates open windows and can grab the screen. G DATA warns that screen capture “can expose information that is only visible during active user sessions.” Combined with script injection, that raises the risk sharply.
Attribution
The apps share the same Electron code base, main.js, and preload.js. That points to one campaign or one source. However, G DATA states it lacks evidence to tie them to a single actor. So the attribution stays suspected, not confirmed.
Detection and defense guidance
Download software only from trusted, official sources. Verify a site before you install its tool. Watch for productivity apps that ship with contextIsolation disabled. Also flag apps that load scripts from a local injection folder or request desktop capture without cause.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
