Notifications
Clear all
Topic starter
21/08/2026 4:44 pm
TL;DR: ManualFinder is a Trojan masquerading as a manual-search app, but Expel found it sitting inside a broader decoy-app network that abuses scheduled tasks, MSHTA, hidden JavaScript, and residential proxy software to turn infected Windows hosts into proxy nodes. The pattern matters because it moves beyond classic PUP behaviour into covert execution and infrastructure abuse, where NHI-style lifecycle control of downloaded code and scheduled automation becomes a real containment issue.
NHIMG editorial — based on content published by Expel: ManualFinder and the broader decoy-app malware network
Questions worth separating out
Q: What breaks when a decoy app is allowed to run as trusted software?
A: The trust boundary breaks down because the app can execute hidden scripts, create persistence, and repurpose the endpoint for proxy traffic while still looking legitimate.
Q: Why do signed utilities still create risk for endpoint and identity governance?
A: A signature proves that some publisher signed the file, not that the software has a trustworthy lifecycle, clean distribution path, or aligned legal identity.
Q: How do security teams know if hidden script persistence is actually contained?
A: Look for the absence of repeated task-driven launches, temporary JavaScript execution, and unexpected outbound connections from the affected host.
Practitioner guidance
- Hunt for persistence via scheduled tasks Query EDR and SIEM data for scheduled tasks that launch node.exe, wscript, or MSHTA from %TEMP% and quarantine the associated scripts and child processes immediately.
- Validate software provenance before trust is granted Check whether the binary signer, product name, download source, and legal entity all point to the same real publisher before allowing installation on managed endpoints.
- Block campaign infrastructure at the network edge Add known delivery and callback domains to DNS and web controls, then monitor for any residual connections to mka3e8.com, y2iax5.com, and 5b7crp.com style destinations.
What's in the full analysis
Expel's full analysis covers the operational detail this post intentionally leaves for the source:
- EDR and SIEM hunting logic for tracing scheduled-task launches, node.exe execution, and MSHTA-backed persistence across an estate.
- IOC detail for hashes, callback domains, and related decoy-app families that can support your detection rules and containment workflow.
- Campaign-level evidence tying certificate signers, fake publisher footprints, and distribution infrastructure together across multiple samples.
- Removal guidance for the broader app family, not just the ManualFinder sample, so teams can scope cleanup consistently.
👉 Read Expel's analysis of the ManualFinder decoy-app malware campaign →
ManualFinder and hidden proxyware: what should defenders hunt first?
Explore further
21/08/2026 5:04 pm
Decoy-app campaigns now behave like software supply chain threats, not classic nuisanceware. The ManualFinder case shows a pattern where a plausible utility is only the front end for hidden script execution, proxy installation, and persistence. That means defenders should stop treating these as merely unwanted applications and start treating them as lifecycle-managed software abuse. The practical conclusion is that allowlisting, provenance checks, and telemetry review must cover the full delivery chain, not just the visible binary.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs , Key Research and Survey Results.
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs , Key Research and Survey Results.
A question worth separating out:
Q: Who is accountable when proxyware or decoy software reaches managed devices?
A: Accountability usually spans endpoint management, software approval, and security operations because the failure is not only technical. The organisation needs ownership for application trust decisions, alert handling, and removal workflows, otherwise decoy software will keep returning through the same weak control point.
👉 Read our full editorial: ManualFinder shows how decoy apps turn Windows hosts into proxy nodes
