Proxyware Malware Poses as YouTube Video Download Site, Delivering Malicious JavaScript

Cybersecurity researchers at AhnLab Security Intelligence Center (ASEC) have uncovered a persistent campaign where attackers distribute proxyware malware through fake YouTube video download pages.

This operation, which mimics legitimate video downloading services, tricks users into installing malicious executables disguised as benign tools like WinMemoryCleaner.

The attackers leverage GitHub for malware hosting, a tactic consistent with prior incidents, leading to widespread infections particularly in South Korea.

By exploiting user searches for YouTube content, the malware propagates via pop-up ads or direct download links that appear with random probability, ensuring a stealthy infection chain that evades casual detection.

Infection Mechanics

The attack begins when users input a YouTube video URL on the fraudulent site and click the download button, which occasionally redirects to a malicious executable named Setup.exe.

This file installs the downloader malware, WinMemoryCleaner.exe, into the %PROGRAMFILES%WinMemoryCleaner directory and executes a batch script, WinMemoryCleanerUpdate.bat, to run it with an “/update” argument.

The malware incorporates anti-analysis techniques, scanning for virtual machines and sandboxes before deploying a PowerShell script that installs Node.js and downloads additional JavaScript payloads.

These scripts are scheduled via Task Scheduler under tasks like “Schedule Update” and “WindowsDeviceUpdates,” enabling periodic execution.

The JavaScript communicates with a command-and-control (C&C) server, transmitting system details such as UUID, IP address, and geolocation, and receives PowerShell commands in return.

These commands facilitate the installation of proxyware variants, including DigitalPulse, Honeygain, and the newly observed Infatica, which hijacks the victim’s network bandwidth for unauthorized proxy services.

For instance, the Infatica variant deploys CleanZilo.exe, which loads infatica_agent.dll to siphon bandwidth, profiting the attackers while degrading the infected system’s performance.

Broader Implications

This campaign represents an evolution in proxyware threats, where attackers repurpose legitimate bandwidth-sharing tools for illicit gains, akin to cryptojacking but focused on network resources rather than CPU cycles.

Unlike voluntary installations where users earn rewards, these infections involuntarily monetize victims’ connections, with profits funneled to the threat actors.

Recent cases show diversification in proxyware types, from DigitalPulse and Honeygain to Infatica, indicating adaptive tactics to bypass detection.

ASEC reports that systems in South Korea are prime targets, with malware employing evasion methods like environment checks and scripted persistence.

To counter this, users should avoid executables from unverified sources, including ad-laden sites and pop-ups.

For remediation, deploying antivirus solutions like AhnLab’s V3 is recommended, which detects variants under signatures such as Dropper/Win.Proxyware.C5783593 and Unwanted/Win.Proxyware.C5790566.

Ongoing monitoring of indicators of compromise (IOCs) is crucial for threat hunters, as attackers continue refining their methods.

Indicators of Compromise (IOCs)

Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates!