Be careful – this fake ad blocker may actually infect your device with malware

Imagine installing an ad blocker that ends up displaying even more adware. What’s worse, this “ad blocker” also steals sensitive data from the device it’s installed on and even allows other malicious actors to run code with elevated privileges.

That’s exactly what HotPage, a new adware module recently discovered by ESET cybersecurity researchers, can do. In its analysis, ESET said it first spotted HotPage in late 2023 posing as an ad blocker, but during installation, it “deploys a driver capable of injecting code into remote processes and two libraries capable of intercepting and manipulating browser network traffic.”

As a result, the malware can modify or completely replace the content of the page the victim is trying to visit. It can redirect them to a completely different page or open a new page in a new tab if necessary.

Displaying advertisements, capturing data, deploying malware

The main purpose of HotPage is to display gaming-related ads, researchers said. However, it can also intercept system information and send it to a remote server registered to the Chinese company Hubei Dunwang Network Technology Co., Ltd, which suggests that the campaign is of Chinese origin. Finally, the malware also allows holders of non-privileged accounts to elevate privileges and run code as the NT AUTHORITY\System account.

“This kernel component inadvertently leaves the door open for other threats to run code at the highest level of privilege available in the Windows operating system: the System account,” the researchers wrote in their paper. “Due to improper access restrictions on this kernel component, all processes can communicate with it and leverage its code injection capabilities to attack any unprotected processes.”

ESET concluded its article by saying that HotPage looks quite generic, but is actually quite advanced.