Trojanized Slack Installer Deploys HVNC Backdoor via Typosquatted Domain (slacks.pro)
Trojanized Slack Installer Deploys HVNC Backdoor via (TL-2026-0374), also tracked as Fake Slack HVNC Campaign, is a high-severity malware campaign, first published 2026-04-16. It carries a reported Russia nexus and is not formally attributed, affects Slack Technologies Slack Desktop, maps to 19 MITRE ATT&CK techniques (T1012, T1027, T1036.005), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0374
- Threat ID
- TL-2026-0374
- Also known as
- Fake Slack HVNC Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-04-16
- Last reviewed
- 2026-04-16
- Attribution confidence
- NONE
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- enterprise, technology, financial, government, education, healthcare
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Trojanized Slack Installer Deploys HVNC Backdoor via
Malware and tooling: HVNC Backdoor, Custom HVNC C2
A trojanized Slack installer distributed through the typosquatted domain slacks.pro silently deploys a Hidden Virtual Network Computing (HVNC) backdoor while installing a legitimate copy of Slack. The unsigned loader contacts C2 infrastructure at 94.232.46.16:8081, downloads an encrypted payload, and injects it into explorer.exe via NtCreateSection-based injection to create a hidden desktop for persistent remote access.
How Trojanized Slack Installer Deploys HVNC Backdoor via works
This campaign leverages typosquatting to distribute a trojanized Slack installer that bundles a legitimate Slack installation with a sophisticated HVNC backdoor. Victims encounter the malicious domain slacks.pro through search engine results or phishing links, where a JavaScript click handler redirects all clicks to initiate the download of slack-4-49-81.exe, a 150MB installer.
The installer abuses the legitimate Squirrel update framework — the same framework used by Slack, Discord, and Microsoft Teams for application updates. Upon execution, the trojanized installer drops two temporary files to %TEMP%: slack.tmp (a genuine Squirrel self-extracting installer containing the real Slack application as a NuGet package slack-4.49.81-full.nupkg) and svc.tmp (an unsigned 519KB malware loader). The legitimate Slack installation proceeds normally via Squirrel's --install flag, complete with branded splash image and standard registry persistence at HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\com.squirrel.slack.slack.
The malware loader (svc.tmp) employs extensive anti-analysis measures. Its PE sections use randomized names (.7ssik, .d1npl, .m6zef) instead of standard .text/.rdata nomenclature. False PE metadata claims the binary is 'Windows Component Update Service v1.4.2.0' by Microsoft Corporation. The import table is minimized to only 90 functions from KERNEL32.dll, with all networking, registry, and process manipulation APIs resolved dynamically at runtime via GetProcAddress and LoadLibraryExW. Anti-debugging checks include IsDebuggerPresent and GetTickCount-based timing evasion.
Before the Slack UI finishes loading, the loader initiates C2 communication via dynamically resolved WinHTTP APIs to 94.232.46.16 on TCP port 8081. The server delivers an encrypted HVNC payload which is decrypted in a second phase (debug strings [P1] for download, [P2] for decryption, [CRYPT] for cryptographic operations). The decrypted payload is validated by checking for the MZ header signature.
Payload injection uses a sophisticated section-based technique targeting explorer.exe: (1) NtCreateSection creates a shared memory section, (2) the section is mapped into both the loader and explorer.exe processes, (3) shellcode and the DLL path are written to the shared region, (4) NtCreateThreadEx creates a remote thread in explorer.exe that loads the DLL from shared memory. A fallback method drops the DLL to disk as wmiprvse_*.tmp if the NT APIs are unavailable.
Once injected, the HVNC module calls the exported HvncRun function, establishing an invisible desktop session completely separate from the user's visible screen. This allows the attacker to operate browsers, access banking portals, and interact with authenticated sessions without the victim's knowledge. The hidden desktop operates within the Windows shell context of explorer.exe, making detection through standard process monitoring difficult.
This campaign shares tactical similarities with a prior operation from August 2024 that used fraudulent Google Ads to redirect victims to trojanized installers delivering SecTopRAT. The pattern of abusing the Squirrel framework for legitimacy while sideloading malware payloads has also been observed in the Coyote banking trojan. The secondary domain debtclean-ua.sbs serves as an additional download host, using the .sbs TLD commonly associated with disposable phishing infrastructure.
MITRE ATT&CK techniques used in TL-2026-0374
Discovery
T1012 Query Registry; T1082 System Information Discovery; T1518.001 Software Discovery: Security Software Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055.001 Process Injection: Dynamic-link Library Injection; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1497.001 Virtualization/Sandbox Evasion: System Checks
Collection
T1056.002 Input Capture: GUI Input Capture
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1571 Non-Standard Port
Execution
T1204.002 User Execution: Malicious File
Impact
Persistence
T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Initial Access
T1566.002 Phishing: Spearphishing Link
Resource Development
Affected products and versions in Trojanized Slack Installer Deploys HVNC Backdoor via
- Slack Technologies — Slack Desktop
Vulnerable versions: 4.49.81 (trojanized copy)
Fixed in: Official builds from slack.com are not affected - Squirrel — Squirrel.Windows Update Framework
Vulnerable versions: Abused as legitimate installation vehicle - Microsoft — Windows
Vulnerable versions: All 64-bit versions (target platform)
Remediation for Trojanized Slack Installer Deploys HVNC Backdoor via
Immediate actions
- Block domain slacks.pro and debtclean-ua.sbs at DNS and web proxy
- Block IP 94.232.46.16 at perimeter firewall (inbound and outbound)
- Hunt for presence of svc.tmp or loader_log.txt in %TEMP% directories across endpoints
- Search for wmiprvse_*.tmp files in temp directories indicating HVNC payload drop
- Scan for the two SHA256 hashes across all endpoints using EDR
- Review DNS logs for any queries to slacks.pro or debtclean-ua.sbs
Workarounds
- Only download Slack from official slack.com domain
- Verify digital signatures on all downloaded installers before execution
- Use official enterprise deployment mechanisms (MSI, SCCM) instead of web downloads
Longer-term hardening
- Deploy EDR with behavioral detection for section-based process injection into explorer.exe
- Implement application whitelisting to prevent unsigned executables in %TEMP% from running
- Monitor for NtCreateSection and NtCreateThreadEx API calls targeting explorer.exe
- Implement DNS filtering to block known typosquatting TLDs (.pro, .sbs) for enterprise software domains
- Enable browser isolation for software download sites
- Train users to verify download URLs match official vendor domains (slack.com)
Weaknesses (CWE) in Trojanized Slack Installer Deploys HVNC Backdoor via
CWE-494, CWE-506
Timeline of Trojanized Slack Installer Deploys HVNC Backdoor via
- Related campaign observed using fraudulent Google Ads to redirect victims to trojanized installers delivering SecTopRAT via similar typosquatting technique
- Malwarebytes reports SecTopRAT bundled in Chrome installer distributed via Google Ads, sharing tactical overlap with this campaign pattern
- Estimated infrastructure preparation period — typosquatted domain slacks.pro and secondary host debtclean-ua.sbs registered and configured with JavaScript redirect handlers
- Trojanized Slack installer (slack-4-49-81.exe) actively distributed via slacks.pro with JavaScript click handlers redirecting all page interactions to malicious download
- Threat cataloged as TL-2026-0374 by Threadlinqs Intelligence for tracking, detection development, and simulation
- File hashes, C2 IP (94.232.46.16:8081), distribution domains, and behavioral indicators published by Malwarebytes for community detection
- Malwarebytes publishes detailed threat intelligence report analyzing the trojanized Slack installer, HVNC backdoor, and complete attack chain including anti-analysis techniques
- As of 2026-05-29, the fake-Slack HVNC campaign (slacks.pro, C2 94.232.46.16:8081) remains active: disclosed by Malwarebytes ~2026-04-16 with no reported takedown, sinkhole, or domain seizure. The named infrastructure was live at disclosure and security feeds still treat it as a current detection priority.
Sources cited for Trojanized Slack Installer Deploys HVNC Backdoor via
- Malwarebytes: A fake Slack download is giving attackers a hidden desktop on your machine
- Malwarebytes: SecTopRAT bundled in Chrome installer distributed via Google Ads (related campaign)
- CYFIRMA: EdskManager RAT - Multi-Stage Malware with HVNC and Evasion Capabilities
- Kaspersky Securelist: Coyote Banking Trojan Abusing Squirrel Installer
- Cybereason: Behind Closed Doors - The Rise of Hidden Malicious Remote Access
- eSentire: Technical Analysis of DarkVNC (HVNC variant)
- MITRE ATT&CK: Process Injection - T1055
- MITRE ATT&CK: Acquire Infrastructure - Domains T1583.001
Threats related to Trojanized Slack Installer Deploys HVNC Backdoor via
Detection coverage for TL-2026-0374
As of 2026-04-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0374 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.