Threat actors behind the Projextor campaign are abusing Electron-based productivity applications to conceal malware-like capabilities behind fully functioning document converters, meal planners, recipe tools, and PDF utilities.
The applications deliver their advertised features, but their shared codebase also enables runtime JavaScript execution and access to desktop-capture functionality creating a serious surveillance and post-compromise risk.
Search-optimized websites and convincing download pages can make unwanted applications appear legitimate, particularly when they offer common functions such as PDF conversion or document editing.
Similar tactics were observed in the TamperedChef campaign, where malicious PDF-editor software was promoted through fraudulent websites and operated as a backdoor beneath a decoy interface.
Researchers identified a cluster of related Electron applications, including Kitchen Canvas, Food or Meal Formula, DocConvertWizard, and several PDF conversion utilities.
Despite differing names and claimed purposes, the samples shared near-identical Electron framework components, including main.js and preload.js, indicating that they likely originated from a common development framework or campaign infrastructure.
Projextor is distributed through websites advertising document conversion, recipe management, and meal-planning applications.
One observed domain, doceditorinc[.]com, appears designed to impersonate the legitimate online document-processing service doceditor[.]in.
Such lookalike infrastructure can be especially effective when paired with search-engine visibility, because victims may download the application after searching for a routine software utility.
The first-stage installers vary in format, with samples packaged using NSIS, Squirrel Installer, and Inno Setup. Regardless of packaging, each acts as a downloader for a second-stage Electron application.
The downloaded Electron package contained the key main.js and preload.js components responsible for the application’s privileged behavior.
Electron combines Chromium and Node.js, allowing applications built with HTML, CSS, and JavaScript to access native desktop resources.
G Data Researchers said that, the campaign reflects a growing pattern of abuse in which attackers exploit users’ trust in free productivity software. Its preload-script mechanism is intended to bridge browser-renderer content with privileged Node.js functionality selectively.
Projextor’s Infection Technique
Electron recommends isolating that bridge, because context isolation prevents loaded web content from directly accessing Electron internals and privileged APIs.
Projextor’s code instead explicitly uses contextIsolation: false. This is a notable red flag: context isolation has been enabled by default since Electron 12 and is a core security recommendation for applications that load web content.
Disabling it can allow renderer-side content to interact with APIs exposed by the preload layer, significantly expanding the impact of compromised or attacker-controlled web content.
The application also suppresses legacy-build warnings through disableOldBuildWarning, apparently preventing users from being alerted to outdated and potentially insecure Electron versions.
More importantly, the preload layer can locate and execute JavaScript modules from a dedicated injection directory.
This creates a modular execution mechanism through which operators could introduce new functionality after installation without replacing the main application binary.
Projextor additionally implements a custom screen-share picker that enumerates available desktops and application windows, displays thumbnails, and selects a capture source through Electron IPC communication.
The applications are therefore not simple fake utilities. They are functional programs with embedded architectural choices that permit behavior far beyond what users would reasonably expect from a PDF converter or meal-planning tool.
Electron’s desktopCapturer API is legitimate functionality designed to obtain desktop media sources for capture through browser media APIs.
In this context, however, desktop enumeration combined with dynamic script execution substantially raises the application’s risk profile.
An operator could potentially capture sensitive documents, authentication prompts, browser sessions, email content, financial records, or collaboration-platform activity visible on a victim’s screen.
Organizations should block the identified infrastructure, hunt for the supplied hashes, and review Electron applications whose preload scripts disable isolation, load remote or injected JavaScript, or expose desktop-capture features without a clear business justification.
IOCs
| Hashes | G DATA Detection |
| A799417BD79060D63E93682F339FBE2868DE3881F9C5865D9B583F5B715C70A9 FlipFormat_610220.exe | Win32.Malware.Projextor.E |
| 71656539CC644513396F56100FFB56F9EF9EAA5B7A16B0773D6E5D370A912A88 PDFGrip_646990.exe | Win32.Malware.Projextor.E |
| e7bc36c7345b3894bc1da3d18ff3dbf0a20713d17b93a585ac0da65776d29027 FoodFormula_822670.exe | Win32.Malware.Projextor.E |
| 3C1DBC3F56E91CC79F0014850E773A7F12BBFEF06680F08F883B2BF12873ECCC KitchenCanvas_748343.exe | Win32.Malware.Projextor.E |
| D50CA2FA212DF1C1FF69B5D26BA594BD39BFD86A71B068A650CC577E5DC9A94E Preload.js | Script.Malware.Projextor.B |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now
