Unveiling BaoLoader: How One Malware Family Abuses Trust for 7 Years

BaoLoader, the malware family now tracked as AppSuite-PDF and PDF Editor campaigns, has been abusing the global trust model of software distribution for more than seven years, according to Expel. The researchers state that the developers used at least 26 code-signing certificates over the period to sign their software and make it appear legitimate.

They registered shell companies in Panama, Malaysia, and the United States to obtain certificates that enabled malicious binaries to bypass antivirus and operating system warnings, with 15 certificates issued for Panama-based companies and five for Malaysia-based ones. The BaoLoader ecosystem includes a string of PDF editors and utilities—AppSuite-PDF, ManualFinder, PDFTools, PDFProSuite, and OneStart—distributed under varying corporate guises but sharing certificate fingerprints.

A consistent tactic across campaigns is the use of backdoored installers, with AppSuite-PDF described as a simple app that downloads and installs the PDF Editor while also hosting a backdoor. The findings highlight how code-signing certificates can be misused to masquerade as legitimate developers, underscoring the need for tighter controls such as app whitelisting.