# Trojanized Slack Installer Deploys HVNC Backdoor via Typosquatted Domain (slacks.pro)

> A trojanized Slack installer distributed through the typosquatted domain slacks.pro silently deploys a Hidden Virtual Network Computing (HVNC) backdoor while installing a legitimate copy of Slack. The unsigned loader contacts C2 infrastructure at 94.232.46.16:8081, downloads an encrypted payload, and injects it into explorer.exe via NtCreateSection-based injection to create a hidden desktop for persistent remote access.

- **Published:** 2026-04-16T12:00:00Z
- **Last reviewed:** 2026-04-16T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0374
- **ID:** TL-2026-0374
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This campaign leverages typosquatting to distribute a trojanized Slack installer that bundles a legitimate Slack installation with a sophisticated HVNC backdoor. Victims encounter the malicious domain slacks.pro through search engine results or phishing links, where a JavaScript click handler redirects all clicks to initiate the download of slack-4-49-81.exe, a 150MB installer.

The installer abuses the legitimate Squirrel update framework — the same framework used by Slack, Discord, and Microsoft Teams for application updates. Upon execution, the trojanized installer drops two temporary files to %TEMP%: slack.tmp (a genuine Squirrel self-extracting installer containing the real Slack application as a NuGet package slack-4.49.81-full.nupkg) and svc.tmp (an unsigned 519KB malware loader). The legitimate Slack installation proceeds normally via Squirrel's --install flag, complete with branded splash image and standard registry persistence at HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\com.squirrel.slack.slack.

The malware loader (svc.tmp) employs extensive anti-analysis measures. Its PE sections use randomized names (.7ssik, .d1npl, .m6zef) instead of standard .text/.rdata nomenclature. False PE metadata claims the binary is 'Windows Component Update Service v1.4.2.0' by Microsoft Corporation. The import table is minimized to only 90 functions from KERNEL32.dll, with all networking, registry, and process manipulation APIs resolved dynamically at runtime via GetProcAddress and LoadLibraryExW. Anti-debugging checks include IsDebuggerPresent and GetTickCount-based timing evasion.

Before the Slack UI finishes loading, the loader initiates C2 communication via dynamically resolved WinHTTP APIs to 94.232.46.16 on TCP port 8081. The server delivers an encrypted HVNC payload which is decrypted in a second phase (debug strings [P1] for download, [P2] for decryption, [CRYPT] for cryptographic operations). The decrypted payload is validated by checking for the MZ header signature.

Payload injection uses a sophisticated section-based technique targeting explorer.exe: (1) NtCreateSection creates a shared memory section, (2) the section is mapped into both the loader and explorer.exe processes, (3) shellcode and the DLL path are written to the shared region, (4) NtCreateThreadEx creates a remote thread in explorer.exe that loads the DLL from shared memory. A fallback method drops the DLL to disk as wmiprvse_*.tmp if the NT APIs are unavailable.

Once injected, the HVNC module calls the exported HvncRun function, establishing an invisible desktop session completely separate from the user's visible screen. This allows the attacker to operate browsers, access banking portals, and interact with authenticated sessions without the victim's knowledge. The hidden desktop operates within the Windows shell context of explorer.exe, making detection through standard process monitoring difficult.

This campaign shares tactical similarities with a prior operation from August 2024 that used fraudulent Google Ads to redirect victims to trojanized installers delivering SecTopRAT. The pattern of abusing the Squirrel framework for legitimacy while sideloading malware payloads has also been observed in the Coyote banking trojan. The secondary domain debtclean-ua.sbs serves as an additional download host, using the .sbs TLD commonly associated with disposable phishing infrastructure.

## MITRE ATT&CK

- T1583.001 Acquire Infrastructure: Domains
- T1566.002 Phishing: Spearphishing Link
- T1204.002 User Execution: Malicious File
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1036.005 Match Legitimate Resource Name or Location
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1055.001 Process Injection: Dynamic-link Library Injection
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1070.004 Indicator Removal: File Deletion
- T1518.001 Software Discovery: Security Software Discovery
- T1082 System Information Discovery
- T1012 Query Registry
- T1071.001 Application Layer Protocol: Web Protocols
- T1571 Non-Standard Port
- T1105 Ingress Tool Transfer
- T1219 Remote Access Tools
- T1056.002 Input Capture: GUI Input Capture
- T1531 Account Access Removal

## Sources

- [Malwarebytes: A fake Slack download is giving attackers a hidden desktop on your machine](https://www.malwarebytes.com/blog/threat-intel/2026/04/a-fake-slack-download-is-giving-attackers-a-hidden-desktop-on-your-machine)
- [Malwarebytes: SecTopRAT bundled in Chrome installer distributed via Google Ads (related campaign)](https://www.malwarebytes.com/blog/threat-intel/2025/02/sectoprat-bundled-in-chrome-installer-distributed-via-google-ads)
- [CYFIRMA: EdskManager RAT - Multi-Stage Malware with HVNC and Evasion Capabilities](https://www.cyfirma.com/research/edskmanager-rat-multi-stage-malware-with-hvnc-and-evasion-capabilities/)
- [Kaspersky Securelist: Coyote Banking Trojan Abusing Squirrel Installer](https://securelist.com/coyote-multi-stage-banking-trojan/111846/)
- [Cybereason: Behind Closed Doors - The Rise of Hidden Malicious Remote Access](https://www.cybereason.com/blog/behind-closed-doors-the-rise-of-hidden-malicious-remote-access)
- [eSentire: Technical Analysis of DarkVNC (HVNC variant)](https://www.esentire.com/blog/technical-analysis-of-darkvnc)
- [MITRE ATT&CK: Process Injection - T1055](https://attack.mitre.org/techniques/T1055/)
- [MITRE ATT&CK: Acquire Infrastructure - Domains T1583.001](https://attack.mitre.org/techniques/T1583/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0374