{"id":127649,"date":"2025-09-23T19:21:12","date_gmt":"2025-09-23T19:21:12","guid":{"rendered":"https:\/\/cybersecuritynews.com\/?p=127649"},"modified":"2025-09-23T19:21:15","modified_gmt":"2025-09-23T19:21:15","slug":"beware-of-fake-online-speedtest-application","status":"publish","type":"post","link":"https:\/\/cybersecuritynews.com\/beware-of-fake-online-speedtest-application\/","title":{"rendered":"Beware of Fake Online Speedtest Application With Obfuscated JS Codes"},"content":{"rendered":"\n

A sophisticated malware campaign has emerged that leverages fake online speed test applications to deploy obfuscated JavaScript payloads on Windows systems.<\/p>\n\n\n\n

These malicious utilities masquerade as legitimate network speed testing tools, manual readers, PDF utilities, and various search frontends to deceive unsuspecting users into installing dangerous code that operates covertly in the background.<\/p>\n\n\n\n

The attack begins when users download what appears to be a functional speed testing application from compromised or malicious domains such as onlinespeedtestservice[.]com.<\/p>\n\n\n\n

Upon installation, the application delivers its advertised functionality, creating a false sense of security<\/a> while simultaneously deploying a hidden Node.js runtime environment alongside heavily obfuscated JavaScript files.<\/p>\n\n\n\n

The visible executable performs as expected, maintaining the user’s trust while the malicious components establish themselves within the system.<\/p>\n\n\n\n

Security Magic analysts identified<\/a> that these applications are packaged using Inno-Packer installers, which bundle legitimate functionality with malicious components including a portable Node runtime, scheduled task configurations, and obfuscated JavaScript payloads that serve no purpose for the application’s primary function.<\/p>\n\n\n\n

The malware operates independently from the main executable, significantly expanding the attack surface and providing threat actors with persistent access to compromised systems.<\/p>\n\n\n

\n
\"\"
Obfuscated JS (Source – Security Magic)<\/figcaption><\/figure><\/div>\n\n\n

The infection establishes persistence through scheduled tasks that execute the malicious JavaScript payload approximately every 12 hours.<\/p>\n\n\n\n

This JavaScript component maintains encrypted communications with command and control servers, specifically cloud.appusagestats.com, and possesses the capability to execute arbitrary code delivered by remote servers.<\/p>\n\n\n\n

The malware queries system information including the Windows registry key HKLM\\Software\\Microsoft\\Cryptography\\MachineGuid to gather machine identification data for transmission to attackers.<\/p>\n\n\n\n

Advanced Obfuscation and Command Execution Mechanisms<\/strong><\/h2>\n\n\n\n

The JavaScript payload employs sophisticated obfuscation<\/a> techniques that conceal its true purpose from security analysis.<\/p>\n\n\n\n

Researchers discovered that the obfuscated code contains encoded strings that can be decoded by patching the return statement of the decode function.<\/p>\n\n\n\n

When decoded, the JavaScript<\/a> reveals its communication protocol with the command and control infrastructure. The malware transmits JSON-formatted data containing version information, system identifiers, and capability flags.<\/p>\n\n\n\n

Analysis of network communications shows the payload can receive and execute PowerShell commands, with researchers observing test executions that displayed message boxes through Windows Forms assemblies.<\/p>\n\n\n\n

The command execution mechanism utilizes Node.js child_process modules to spawn system processes, enabling arbitrary code execution with user privileges while maintaining stealth through hidden window modes and no-profile PowerShell executions.<\/p>\n\n\n\n

Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

A sophisticated malware campaign has emerged that leverages fake online speed test applications to deploy obfuscated JavaScript payloads on Windows systems. These malicious utilities masquerade as legitimate network speed testing tools, manual readers, PDF utilities, and various search frontends to deceive unsuspecting users into installing dangerous code that operates covertly in the background. The attack […]<\/p>\n","protected":false},"author":6,"featured_media":127736,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgd0ce9rozqyv9a5pt3v0evOT2IUnUqtEHvyPeGVbhDOWY04j1jm7-QnhEeYgvIaundcW_4scIo9qtdxE6Zsj6hIrRZm7T-ys9xNBqJonLtF3gxX99akrG4Ay_mxn2HgRwgB87HuEWl8-bEb_iTw_ANrjWqWhnijgT5wwAA8oT2zePB-UU-iOikx8qLtvg\/s16000\/Beware%20of%20Fake%20Online%20Speedtest%20Application%20With%20Obfuscated%20JS%20Codes.webp","fifu_image_alt":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[11,48],"tags":[149,151],"class_list":{"0":"post-127649","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-cyber-security-news","8":"category-threats","9":"tag-cyber-security","10":"tag-cyber-security-news"},"yoast_head":"\nBeware of Fake Online Speedtest Application With Obfuscated JS Codes<\/title>\n<meta name=\"description\" content=\"Malware hides in fake speed test apps, dropping obfuscated JavaScript via Node.js on Windows while posing as legit utilities.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cybersecuritynews.com\/beware-of-fake-online-speedtest-application\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Beware of Fake Online Speedtest Application With Obfuscated JS Codes\" \/>\n<meta property=\"og:description\" content=\"Malware hides in fake speed test apps, dropping obfuscated JavaScript via Node.js on Windows while posing as legit utilities.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cybersecuritynews.com\/beware-of-fake-online-speedtest-application\/\" \/>\n<meta property=\"og:site_name\" content=\"Cyber Security News\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Hackingtutorialsandnews\" \/>\n<meta property=\"article:published_time\" content=\"2025-09-23T19:21:12+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-09-23T19:21:15+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgd0ce9rozqyv9a5pt3v0evOT2IUnUqtEHvyPeGVbhDOWY04j1jm7-QnhEeYgvIaundcW_4scIo9qtdxE6Zsj6hIrRZm7T-ys9xNBqJonLtF3gxX99akrG4Ay_mxn2HgRwgB87HuEWl8-bEb_iTw_ANrjWqWhnijgT5wwAA8oT2zePB-UU-iOikx8qLtvg\/s16000\/Beware%20of%20Fake%20Online%20Speedtest%20Application%20With%20Obfuscated%20JS%20Codes.webp\" \/><meta property=\"og:image\" content=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgd0ce9rozqyv9a5pt3v0evOT2IUnUqtEHvyPeGVbhDOWY04j1jm7-QnhEeYgvIaundcW_4scIo9qtdxE6Zsj6hIrRZm7T-ys9xNBqJonLtF3gxX99akrG4Ay_mxn2HgRwgB87HuEWl8-bEb_iTw_ANrjWqWhnijgT5wwAA8oT2zePB-UU-iOikx8qLtvg\/s16000\/Beware%20of%20Fake%20Online%20Speedtest%20Application%20With%20Obfuscated%20JS%20Codes.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"900\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Tushar Subhra Dutta\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgd0ce9rozqyv9a5pt3v0evOT2IUnUqtEHvyPeGVbhDOWY04j1jm7-QnhEeYgvIaundcW_4scIo9qtdxE6Zsj6hIrRZm7T-ys9xNBqJonLtF3gxX99akrG4Ay_mxn2HgRwgB87HuEWl8-bEb_iTw_ANrjWqWhnijgT5wwAA8oT2zePB-UU-iOikx8qLtvg\/s16000\/Beware%20of%20Fake%20Online%20Speedtest%20Application%20With%20Obfuscated%20JS%20Codes.webp\" \/>\n<meta name=\"twitter:creator\" content=\"@The_Cyber_News\" \/>\n<meta name=\"twitter:site\" content=\"@The_Cyber_News\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Tushar Subhra Dutta\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Beware of Fake Online Speedtest Application With Obfuscated JS Codes","description":"Malware hides in fake speed test apps, dropping obfuscated JavaScript via Node.js on Windows while posing as legit utilities.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cybersecuritynews.com\/beware-of-fake-online-speedtest-application\/","og_locale":"en_US","og_type":"article","og_title":"Beware of Fake Online Speedtest Application With Obfuscated JS Codes","og_description":"Malware hides in fake speed test apps, dropping obfuscated JavaScript via Node.js on Windows while posing as legit utilities.","og_url":"https:\/\/cybersecuritynews.com\/beware-of-fake-online-speedtest-application\/","og_site_name":"Cyber Security News","article_publisher":"https:\/\/www.facebook.com\/Hackingtutorialsandnews","article_published_time":"2025-09-23T19:21:12+00:00","article_modified_time":"2025-09-23T19:21:15+00:00","og_image":[{"url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgd0ce9rozqyv9a5pt3v0evOT2IUnUqtEHvyPeGVbhDOWY04j1jm7-QnhEeYgvIaundcW_4scIo9qtdxE6Zsj6hIrRZm7T-ys9xNBqJonLtF3gxX99akrG4Ay_mxn2HgRwgB87HuEWl8-bEb_iTw_ANrjWqWhnijgT5wwAA8oT2zePB-UU-iOikx8qLtvg\/s16000\/Beware%20of%20Fake%20Online%20Speedtest%20Application%20With%20Obfuscated%20JS%20Codes.webp","type":"","width":"","height":""},{"width":1600,"height":900,"url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgd0ce9rozqyv9a5pt3v0evOT2IUnUqtEHvyPeGVbhDOWY04j1jm7-QnhEeYgvIaundcW_4scIo9qtdxE6Zsj6hIrRZm7T-ys9xNBqJonLtF3gxX99akrG4Ay_mxn2HgRwgB87HuEWl8-bEb_iTw_ANrjWqWhnijgT5wwAA8oT2zePB-UU-iOikx8qLtvg\/s16000\/Beware%20of%20Fake%20Online%20Speedtest%20Application%20With%20Obfuscated%20JS%20Codes.webp","type":"image\/jpeg"}],"author":"Tushar Subhra Dutta","twitter_card":"summary_large_image","twitter_image":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgd0ce9rozqyv9a5pt3v0evOT2IUnUqtEHvyPeGVbhDOWY04j1jm7-QnhEeYgvIaundcW_4scIo9qtdxE6Zsj6hIrRZm7T-ys9xNBqJonLtF3gxX99akrG4Ay_mxn2HgRwgB87HuEWl8-bEb_iTw_ANrjWqWhnijgT5wwAA8oT2zePB-UU-iOikx8qLtvg\/s16000\/Beware%20of%20Fake%20Online%20Speedtest%20Application%20With%20Obfuscated%20JS%20Codes.webp","twitter_creator":"@The_Cyber_News","twitter_site":"@The_Cyber_News","twitter_misc":{"Written by":"Tushar Subhra Dutta","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/cybersecuritynews.com\/beware-of-fake-online-speedtest-application\/#article","isPartOf":{"@id":"https:\/\/cybersecuritynews.com\/beware-of-fake-online-speedtest-application\/"},"author":{"name":"Tushar Subhra Dutta","@id":"https:\/\/cybersecuritynews.com\/#\/schema\/person\/7eb7d8d026aa5dd566f134d4def5c05c"},"headline":"Beware of Fake Online Speedtest Application With Obfuscated JS Codes","datePublished":"2025-09-23T19:21:12+00:00","dateModified":"2025-09-23T19:21:15+00:00","mainEntityOfPage":{"@id":"https:\/\/cybersecuritynews.com\/beware-of-fake-online-speedtest-application\/"},"wordCount":421,"publisher":{"@id":"https:\/\/cybersecuritynews.com\/#organization"},"image":{"@id":"https:\/\/cybersecuritynews.com\/beware-of-fake-online-speedtest-application\/#primaryimage"},"thumbnailUrl":"https:\/\/i1.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgd0ce9rozqyv9a5pt3v0evOT2IUnUqtEHvyPeGVbhDOWY04j1jm7-QnhEeYgvIaundcW_4scIo9qtdxE6Zsj6hIrRZm7T-ys9xNBqJonLtF3gxX99akrG4Ay_mxn2HgRwgB87HuEWl8-bEb_iTw_ANrjWqWhnijgT5wwAA8oT2zePB-UU-iOikx8qLtvg\/s16000\/Beware%20of%20Fake%20Online%20Speedtest%20Application%20With%20Obfuscated%20JS%20Codes.webp?w=1600&resize=1600,900&ssl=1","keywords":["cyber security","cyber security news"],"articleSection":["Cyber Security News","Threats"],"inLanguage":"en-US","copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/cybersecuritynews.com\/#organization"}},{"@type":"WebPage","@id":"https:\/\/cybersecuritynews.com\/beware-of-fake-online-speedtest-application\/","url":"https:\/\/cybersecuritynews.com\/beware-of-fake-online-speedtest-application\/","name":"Beware of Fake Online Speedtest Application With Obfuscated JS Codes","isPartOf":{"@id":"https:\/\/cybersecuritynews.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cybersecuritynews.com\/beware-of-fake-online-speedtest-application\/#primaryimage"},"image":{"@id":"https:\/\/cybersecuritynews.com\/beware-of-fake-online-speedtest-application\/#primaryimage"},"thumbnailUrl":"https:\/\/i1.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgd0ce9rozqyv9a5pt3v0evOT2IUnUqtEHvyPeGVbhDOWY04j1jm7-QnhEeYgvIaundcW_4scIo9qtdxE6Zsj6hIrRZm7T-ys9xNBqJonLtF3gxX99akrG4Ay_mxn2HgRwgB87HuEWl8-bEb_iTw_ANrjWqWhnijgT5wwAA8oT2zePB-UU-iOikx8qLtvg\/s16000\/Beware%20of%20Fake%20Online%20Speedtest%20Application%20With%20Obfuscated%20JS%20Codes.webp?w=1600&resize=1600,900&ssl=1","datePublished":"2025-09-23T19:21:12+00:00","dateModified":"2025-09-23T19:21:15+00:00","description":"Malware hides in fake speed test apps, dropping obfuscated JavaScript via Node.js on Windows while posing as legit utilities.","breadcrumb":{"@id":"https:\/\/cybersecuritynews.com\/beware-of-fake-online-speedtest-application\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cybersecuritynews.com\/beware-of-fake-online-speedtest-application\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cybersecuritynews.com\/beware-of-fake-online-speedtest-application\/#primaryimage","url":"https:\/\/i1.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgd0ce9rozqyv9a5pt3v0evOT2IUnUqtEHvyPeGVbhDOWY04j1jm7-QnhEeYgvIaundcW_4scIo9qtdxE6Zsj6hIrRZm7T-ys9xNBqJonLtF3gxX99akrG4Ay_mxn2HgRwgB87HuEWl8-bEb_iTw_ANrjWqWhnijgT5wwAA8oT2zePB-UU-iOikx8qLtvg\/s16000\/Beware%20of%20Fake%20Online%20Speedtest%20Application%20With%20Obfuscated%20JS%20Codes.webp?w=1600&resize=1600,900&ssl=1","contentUrl":"https:\/\/i1.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgd0ce9rozqyv9a5pt3v0evOT2IUnUqtEHvyPeGVbhDOWY04j1jm7-QnhEeYgvIaundcW_4scIo9qtdxE6Zsj6hIrRZm7T-ys9xNBqJonLtF3gxX99akrG4Ay_mxn2HgRwgB87HuEWl8-bEb_iTw_ANrjWqWhnijgT5wwAA8oT2zePB-UU-iOikx8qLtvg\/s16000\/Beware%20of%20Fake%20Online%20Speedtest%20Application%20With%20Obfuscated%20JS%20Codes.webp?w=1600&resize=1600,900&ssl=1","width":"1600","height":"900"},{"@type":"BreadcrumbList","@id":"https:\/\/cybersecuritynews.com\/beware-of-fake-online-speedtest-application\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cybersecuritynews.com\/"},{"@type":"ListItem","position":2,"name":"Beware of Fake Online Speedtest Application With Obfuscated JS Codes"}]},{"@type":"WebSite","@id":"https:\/\/cybersecuritynews.com\/#website","url":"https:\/\/cybersecuritynews.com\/","name":"Cyber Security News","description":"World's #1 Premier Cybersecurity and Hacking News Portal","publisher":{"@id":"https:\/\/cybersecuritynews.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cybersecuritynews.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/cybersecuritynews.com\/#organization","name":"Cyber Security News","url":"https:\/\/cybersecuritynews.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cybersecuritynews.com\/#\/schema\/logo\/image\/","url":"https:\/\/cybersecuritynews.com\/wp-content\/uploads\/2021\/06\/Cyber-security.jpg","contentUrl":"https:\/\/cybersecuritynews.com\/wp-content\/uploads\/2021\/06\/Cyber-security.jpg","width":200,"height":200,"caption":"Cyber Security News"},"image":{"@id":"https:\/\/cybersecuritynews.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/Hackingtutorialsandnews","https:\/\/x.com\/The_Cyber_News","https:\/\/www.linkedin.com\/company\/cybersecurity-news\/"]},{"@type":"Person","@id":"https:\/\/cybersecuritynews.com\/#\/schema\/person\/7eb7d8d026aa5dd566f134d4def5c05c","name":"Tushar Subhra Dutta","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cybersecuritynews.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/f8bc0247220c7d4dea6c8b5a77d910613305ead17b13c2a7920b400435a848dd?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f8bc0247220c7d4dea6c8b5a77d910613305ead17b13c2a7920b400435a848dd?s=96&d=mm&r=g","caption":"Tushar Subhra Dutta"},"description":"Tushar is a senior cybersecurity and breach reporter. He specializes in covering cybersecurity news, trends, and emerging threats, data breaches, and malware attacks. With years of experience, he brings clarity and depth to complex security topics.","url":"https:\/\/cybersecuritynews.com\/author\/tushar\/"}]}},"jetpack_featured_media_url":"https:\/\/i1.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgd0ce9rozqyv9a5pt3v0evOT2IUnUqtEHvyPeGVbhDOWY04j1jm7-QnhEeYgvIaundcW_4scIo9qtdxE6Zsj6hIrRZm7T-ys9xNBqJonLtF3gxX99akrG4Ay_mxn2HgRwgB87HuEWl8-bEb_iTw_ANrjWqWhnijgT5wwAA8oT2zePB-UU-iOikx8qLtvg\/s16000\/Beware%20of%20Fake%20Online%20Speedtest%20Application%20With%20Obfuscated%20JS%20Codes.webp?w=1600&resize=1600,900&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/posts\/127649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/comments?post=127649"}],"version-history":[{"count":1,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/posts\/127649\/revisions"}],"predecessor-version":[{"id":127735,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/posts\/127649\/revisions\/127735"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/media\/127736"}],"wp:attachment":[{"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/media?parent=127649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/categories?post=127649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/tags?post=127649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}