Trojanised apps and PUPs are blurring endpoint risk boundaries

At a glance

What this is: This is Expel’s analysis of quarter-over-quarter endpoint threat activity, centred on BaoLoader and related trojanised application campaigns that disguise backdoors inside apparently useful software.

Why it matters: It matters because application trust, software allowlisting, and execution controls now sit on the same risk path as endpoint detection for teams managing human endpoints and identity-backed access.

By the numbers:

• BaoLoader comprised 13% of the non-targeted malware Expel investigated this quarter.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.

👉 Read Expel’s Q3 2025 threat report on BaoLoader and trojanised apps

Context

Trojanised applications create a governance problem as much as a malware problem. A tool can appear functional to the user while quietly introducing a backdoor, which means endpoint trust decisions have to cover software provenance, execution behaviour, and what the application is allowed to do after installation. In identity terms, that includes the permissions the software inherits once it runs inside a user session.

This report is also relevant to IAM and NHI practitioners because the same trust gap that lets a deceptive desktop app run arbitrary commands often appears in broader access pathways. Once an endpoint or user session is compromised, attackers can reach secrets, tokens, or delegated access that were never meant to be exposed to a benign-looking utility. That makes application control part of identity governance, not just endpoint hygiene.

The activity described here is not unusual in shape, even if the packaging changes over time. Functional applications with hidden payloads remain attractive because they blend into normal work patterns and are harder for users to question.

Key questions

Q: What breaks when trojanised applications are not blocked on endpoints?

A: The control boundary between user intent and software behaviour breaks first. A functional app can carry a backdoor, run scripts, and create a foothold that outlives the original install event. That means a normal download becomes a security decision with endpoint, identity, and data consequences. Application control has to assume the installer may be useful and still hostile.

Q: Why do deceptive productivity apps increase identity and access risk?

A: Because they inherit the rights of the user who launches them. If the software can access browser sessions, local tokens, or connected services, it can turn ordinary user access into a pivot into higher-value systems. The risk is not only malware on a host. It is the abuse of legitimate access paths that were never meant to be consumed by hidden code.

Q: How do security teams know if business application controls are working?

A: Look for three signals: fewer standing exceptions, cleaner SoD outcomes after role combination tests, and access review results that consistently remove unused permissions. If the same people keep receiving broad access across projects or system changes, the control model is drifting. Effective governance should narrow access over time, not accumulate it.

Q: Who is accountable when a backdoored business app reaches a corporate endpoint?

A: Accountability usually spans endpoint security, application governance, and the business owner who approved the exception. If the organisation allows unsigned, weakly reviewed, or ad-sourced software, then the control failure is administrative as well as technical. Frameworks such as CIS Controls and NIST CSF place that responsibility on controlled software management and continuous monitoring.

Technical breakdown

How trojanised apps hide malicious behaviour inside normal functionality

Trojanised software is not necessarily broken software. In these campaigns, the application performs the advertised task while also shipping hidden behaviour such as a backdoor, command execution, or covert data transfer. That duality makes reputation-based trust weak, because the user sees utility while the attacker gets persistence or remote control. Code-signing certificates can add another layer of legitimacy, especially when the operator rotates through multiple companies to obtain them. The result is a control gap between software appearance, installation approval, and post-install runtime behaviour.

Practical implication: enforce application control and inspect runtime behaviour, not just installer reputation.

Why PowerShell and antivirus enumeration matter in these campaigns

When malware executes PowerShell to enumerate installed antivirus, it is testing the defensive environment and preparing for the next stage of abuse. PowerShell gives attackers a flexible native execution path, while antivirus discovery helps them avoid detection or choose a quieter payload. In endpoint terms, this is not a random artefact. It is a sign that the software has moved from nuisance to active operator control. Once arbitrary commands are possible, the issue shifts from unwanted software to post-compromise action on the host.

Practical implication: alert on script execution and endpoint discovery behaviour from software that should not need it.

How AI-assisted development changes the trojanised app problem

Large language models do not create the criminal model, but they lower the cost of producing convincing decoy applications and plausible interfaces. That matters because the barrier is no longer only technical sophistication. It is now also speed, scale, and variation. The same basic malicious pattern can be rewrapped in many product skins, which makes user intuition and static signatures less reliable. For defenders, this pushes the problem toward governance over what software may run, how it is validated, and how exceptions are approved and reviewed.

Practical implication: treat software approval as a governed process, not a one-time install decision.

Threat narrative

Attacker objective: The attacker wants monetisation through install-based fraud while preserving a backdoor that can be reused for later endpoint control.

1. Entry occurs when users download a functional but deceptive application such as a PDF editor, calendar tool, or recipe app from a trusted-looking channel or ad placement. Credential access is not the primary goal here, but the backdoor grants the operator arbitrary command execution on the endpoint. Escalation follows when the malware checks for antivirus, installs additional applications, or prepares the host for further abuse. Impact is the creation of a durable foothold that supports affiliate fraud today and could support broader compromise tomorrow.

NHI Mgmt Group analysis

Trojanised productivity software is an application trust problem first and a malware problem second. The deceptive app pattern works because defenders often evaluate software by apparent function, not by the authority it gains after installation. Once a user accepts the binary, the malware inherits the endpoint context that the user already has. That makes software provenance, execution policy, and installation governance part of endpoint identity control, not separate concerns.

Software that behaves like a tool but acts like a backdoor creates hidden privilege inheritance. A utility application can still reach scripts, local data, browser sessions, and sometimes stored secrets if the environment is permissive enough. That is where identity and endpoint controls intersect: access granted to the user becomes the starting point for the software’s abuse path. Teams should treat user-space software as a potential privilege bridge, especially where application control is weak.

AI lowers the cost of scale, not the logic of the attack. The article’s suggestion that LLMs help attackers produce convincing decoy applications is credible because the malicious pattern is already simple: hide the real payload behind a useful interface. What changes is the speed at which variants can be generated and tested. That makes static detection less durable and increases the value of policy enforcement, reputation signals, and runtime inspection. Practitioners should assume the same abuse pattern will keep reappearing in new wrappers.

Application allowlisting needs to be framed as governance over software intent, not only software inventory. Knowing what is installed is not enough if the installed application can quietly introduce a backdoor or execute scripts beyond its declared purpose. Security teams need to distinguish sanctioned business software from software that merely looks useful enough to pass user scrutiny. The practical conclusion is simple: if an app can modify the endpoint beyond its core function, it belongs in a governed exception path.

What this signals

Trojanised applications should now be treated as a control-plane issue for endpoint software governance. The practical pattern is consistent: attractive utility on the surface, hidden execution underneath, and a path from user trust to broader compromise. Where identity systems depend on the endpoint to protect sessions and tokens, application control becomes part of identity security rather than a separate hygiene layer.

Hidden privilege inheritance: this is the real governance problem the article exposes. Once a utility app runs inside a legitimate user context, it can access the same local and cloud-adjacent pathways that the user can reach, which is why approvals must consider runtime behaviour, not just installation intent.

For practitioners, the signal is to connect endpoint policy with identity safeguards and software supply governance. Use CIS Controls v8 for controlled software management and monitoring, and align allowlisting with NIST SP 800-53 Rev 5 Security and Privacy Controls where application execution and auditing need stronger enforcement.

For practitioners

• Tighten application allowlisting for user endpoints Block installations of utilities that are not pre-approved, and review exceptions for browser extensions, PDF tools, and downloader apps that commonly masquerade as productivity software.
• Detect script execution from low-trust software Alert when newly installed applications spawn PowerShell, enumerate antivirus products, or launch secondary payloads that are outside their declared business function.
• Validate software provenance before approval Require publisher verification, code-signing checks, and change-review evidence for business apps sourced from ads, unofficial sites, or reseller channels.
• Separate user utility from privilege-bearing workflows Do not allow everyday desktop tools to reach sensitive sessions, secrets, or admin workflows unless the app has been explicitly assessed and compartmentalised.

Key takeaways

• Trojanised applications blur the line between legitimate utility and malicious execution, which turns software approval into a governance decision.
• Expel’s quarter analysis shows that this pattern is not fringe activity, with BaoLoader alone representing 13% of non-targeted malware in the period studied.
• Endpoint teams should combine application control, runtime detection, and exception governance so disguised apps cannot quietly inherit user trust.

Key terms

• Trojanized Application: A trojanized application is a legitimate-looking app that has been altered to carry malicious code. Users believe they are installing a normal tool, but the bundled payload can execute backdoors, steal data, or establish persistence immediately after launch.
• Application Allowlisting: Application allowlisting is the practice of permitting only approved software to run or be installed on a device. It reduces the chance of malicious or unmanaged apps changing the device’s behaviour, and it is especially useful where mobile endpoints must remain tightly governed.
• Privilege Inheritance: Privilege inheritance occurs when a system uses the permissions of the human or service identity that launched it. For agents, this means the workload can access anything the parent role can access, which makes entitlement design more important than the model’s natural-language capabilities.
• Code Signing Certificate: A code signing certificate is a digital credential used to prove that software came from a trusted publisher and has not been altered. In identity terms, it is a non-human identity that authorizes release activity, and its value depends on lifecycle control, key custody, and revocation discipline.

What's in the full article

Expel's full blog covers the operational detail this post intentionally leaves for the source:

• The quarter-by-quarter threat breakdown behind BaoLoader, TamperedChef, and related commodity malware activity.
• The certificate-signing and certificate-revocation details that helped track campaign evolution over time.
• The specific software families and distribution patterns used to spread fake productivity apps.
• The researchers' reasoning on why LLMs may be lowering the cost of producing deceptive applications.

👉 Expel’s full post covers the campaign history, certificate abuse, and app control recommendations in more detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, workload identity, and agentic AI identity. It helps practitioners connect identity controls to the wider security programme they operate every day.