Popular Chinese Utility Hijacked to Deploy Browser Malware

The RedDrip Team at QiAnXin Technology’s Threat Intelligence Center has uncovered a widespread malware campaign hiding inside a popular productivity tool called Office Assistant, which has been loading malicious components to deliver a browser-hijacking plugin named Mltab. The attack, active since at least May 2024, has reportedly affected nearly one million terminals, turning a trusted helper into a digital spy.

It leverages valid digital signatures to mask its activity, with malicious DLLs such as OfficeTeamAddin.dll bearing signed certificates from entities like Ample Digital Limited and Hangil IT Co., Ltd, which have since been revoked. Once installed, the Mltab plugin monitors user traffic, hijacks browser behaviour, and replaces legitimate links with revenue-generating redirects, including a hijacked New Tab page and a “Search with Baidu” context menu item.

The campaign’s infrastructure appears robust, with C2 domains like fh67k[.]com, eybyyffs[.]com, and cjtab[.]com ranked within the top 1 million domains on OpenDNS, and Office Assistant Version 3.1.10[.]1, released on 28 May 2024, introducing a downloader that requests the C2 domain and drops a DLL. Tianqing has been updated to detect and remove Trojan.MPE[.]Mltab, and users are urged to scan systems and check for unfamiliar extensions. According to QiAnXin Technology’s Threat Intelligence Center.