CloudSEK’s security researchers have uncovered a sophisticated malware campaign using fake PDF-to-DOCX conversion tools to infect unsuspecting users with a powerful information stealer. This comes just weeks after the FBI’s Denver office issued a public alert warning of malicious online file converters being leveraged to deliver malware.
The report reveals how cybercriminals have crafted deceptive websites, such as candyxpdf[.]com and candyconverterpdf[.]com, that meticulously mimic the legitimate pdfcandy.com service.
These fraudulent platforms lure users into executing a malicious PowerShell command, initiating a complex infection chain that delivers malware capable of stealing sensitive data, including browser credentials, cryptocurrency wallets, and other personal information.
A Sophisticated Blend of Deception and Technology
The campaign employs advanced social engineering to exploit users’ trust. Victims uploading a PDF for conversion encounter a fake processing animation, followed by an unexpected CAPTCHA prompt designed to enhance the site’s perceived legitimacy and rush users into action. This leads to instructions to run a PowerShell command, which triggers a redirection chain through domains like bind-new-connect[.]click, ultimately delivering a malicious “adobe.zip” payload. The archive contains “audiobit[.]exe,” which leverages legitimate Windows tools like MSBuild[.]exe to deploy Arechclient2. (Read Full Report, For More Information)
“This campaign highlights how cybercriminals exploit everyday digital tools. By combining psychological manipulation with technical sophistication, these attackers turn routine tasks like file conversion into opportunities for data theft. Our research aims to equip individuals and organizations with the knowledge to stay safe,” said Varun Ajmera, Threat Intelligence Researcher, CloudSEK.
The scale of this threat becomes clear when considering the popularity of the legitimate PDFCandy.com, which attracts approximately 2.8 million monthly visits. Notably, India represents the largest segment of its user base, accounting for 19.07% or roughly 533,960 monthly visitors. This substantial audience provides a vast pool of potential victims for the threat actors behind this malicious campaign. While the fraudulent sites, candyxpdf[.]com and candyconverterpdf[.]com, saw approximately 2,300 and 4,100 visits respectively in March 2025, these numbers demonstrate active exploitation of the impersonated service’s popularity.
How the Attack Works
- Spoofed Websites: Domains like candyxpdf[.]com and candyconverterpdf[.]com imitate the real PDFCandy website.
- Deceptive Flow: Fake file conversion followed by a CAPTCHA prompt creates trust and urgency.
- Malware Trigger: Users are prompted to run a PowerShell command, leading to the download of a malicious ZIP file masquerading as a legitimate Adobe resource.
- Payload Execution: The ZIP contains audiobit.exe, which executes via MSBuild.exe – a legitimate Windows utility weaponized to run ArechClient2. (Read Full Report, For More Information)
CloudSEK’s technical analysis traced the malware delivery chain through multiple redirections, eventually landing on a known malicious domain (bind-new-connect[.]click) to deliver the payload. The attacker’s infrastructure, command chain, and payload hashes are included in the full report.
Wider Implications
This campaign demonstrates a growing trend where attackers prey on routine digital activities—like file conversion—to compromise systems. Given the increasing use of online converters in corporate and personal workflows, this type of attack has wide-ranging implications for cybersecurity hygiene.
Protecting Against the Threat
CloudSEK’s report provides actionable recommendations to safeguard individuals and organizations:
- Stick to Trusted Tools: Use reputable file conversion services from official websites and avoid unverified “free” converters.
- Strengthen Technical Defenses: Keep antivirus software updated, deploy endpoint detection and response (EDR) solutions, and use DNS filtering to block malicious domains.
- Educate Users: Train employees to recognize red flags, such as suspicious URLs, unexpected CAPTCHAs, or prompts to run command-line instructions.
- Incident Response: Isolate compromised devices, change passwords from a clean device, and report incidents to authorities promptly.
- Offline Alternatives: Consider offline conversion tools to avoid uploading sensitive files to remote servers.
A Call to Vigilance
As online file converters remain a staple in digital workflows, this campaign underscores the need for heightened awareness. “As threat actors become more creative with their tactics, cybersecurity must evolve to prioritize behavior-based detection, user awareness, and zero-trust principles. Organizations should invest in robust endpoint security, DNS filtering, and employee training. Most importantly, we need to reduce reliance on unknown web-based tools and encourage the use of secure, offline alternatives for tasks like file conversion,” said Varun Ajmera, Threat Intelligence Researcher, CloudSEK.
About CloudSEK: CloudSEK is a contextual AI company that predicts Cyber Threats. Our Cloud SaaS platform constantly seeks security solutions for our customers’ digital risks.
To learn more about how CloudSEK can strengthen your external security posture and deliver value from Day One, visit https://cloudsek.com or drop a note to info@cloudsek.com.
Hertz Has Been Pwned Via A Third Party Vulnerability
Posted in Commentary on April 15, 2025 by itnerdRental car company Hertz says it suffered a data breach, attributed to software maker Cleo, that included customers personal information and driver’s licenses. Hertz has put up a page on this which you can see here:
hertz.com/content/dam/hertz/global/resources/Notice_of_Data_Incident-United_States.pdf
Ensar Seker, CISO at SOCRadar had this comment:
“The data breach impacting Hertz and its associated brands is a textbook example of how third-party vulnerabilities can cascade into massive data exposure, even for well-established enterprises. What makes this breach especially concerning is the type of data compromised, not just names and contact details, but driver’s licenses, payment card information, Social Security numbers, and even workers’ compensation claims. This is prime identity theft material, and unfortunately, once it’s leaked, there’s no putting the genie back in the bottle.
“The breach relates to a known vulnerability exploited by the Clop ransomware group in Cleo’s enterprise file transfer solution. Last year, Cleo was already on the radar for widespread exploitation by Russian-linked actors, yet many organizations were slow to identify and isolate exposure paths. This reinforces a painful truth: companies are only as secure as their most vulnerable vendor.
“Hertz may not have been directly compromised, but its vendor relationships introduced risk vectors that weren’t fully mitigated. This is a growing pattern across the ransomware landscape, where attackers target software supply chains to scale their reach and impact.
“For consumers, the aftermath is frustratingly familiar. A driver’s license or Social Security number cannot be ‘reset’ like a password. These data points are permanent identifiers, and once they are exposed, victims become vulnerable to synthetic identity fraud, targeted phishing, and even fraudulent claims or loans.
“This breach highlights the necessity for increased proactive vendor due diligence, enhanced threat intelligence sharing, and stronger regulatory pressure on third-party software providers to comply with contemporary security standards. The risks impact millions of individuals and the public’s trust in digital infrastructure.”
Javvad Malik, lead security awareness advocate at KnowBe4 follows with this:
Zero-day vulnerabilities are rare, but when they occur have a large impact. Even if Hertz had all their systems patched and up to date, it would have been difficult to protect against the Cleo zero day attack. Offering identity monitoring is all well and good, but it is very much a case of bolting the barn door once the horse has bolted. The real challenge lies in staying ahead of these evolving threats. Organizations need to shift their mindset from reactive to proactive. Defense in depth needs to be adequately configured so that even if one system is compromised through a zero day, the whole infrastructure doesn’t fall like a house of cards. Part of this is building a strong security culture, where security is embedded throughout the organization and not just limited to the security team.
This is something that I will watch closely as my wife and I used Hertz when we were in France in 2023. Thus there is always the possibility that we’re impacted. Regardless, this is another example of you’re only as secure as the people your company works with. On top of that, why did it take so long for Hertz to report this? That’s a question that I would like answered sooner rather than later.
Leave a comment »