Beware of Fake Online Speedtest Apps with Hidden JavaScript Code

A GBHackers News report warns of fake online speedtest apps that disguise themselves with hidden JavaScript code and payloads designed to compromise systems and privacy. The infection begins when a user downloads what looks like a standard speedtest tool; once installed, the program unpacks itself with the Inno Setup Packer and deploys Node.js alongside an obfuscated JavaScript file.

A scheduled task launches the script via Node to execute a file named temp.js, which then decodes its payload through a multi-stage routine. The malware harvests system identifiers, builds a JSON object including MachineGuid and version metadata, and transmits it via HTTPS POST to cloud.appusagestats[.]com, with security researchers later demonstrating the exact POST body during analysis.

After exfiltration, the C2 server can issue commands via an XOR-encoded JSON payload, and the malware uses Node.js’s child_process.exec to run system commands, potentially enabling credential dumping, ransomware deployment, or lateral movement. Mitigations include auditing scheduled tasks, checking for Node.js binaries in unexpected directories, and blocking unexpected .js execution, while emphasising vigilance over trusted sources and anomalous network activity.