PDFescape install chain delivered coin miner

The PDFescape case is more subtle than a backdoored download button. Microsoft described it as a supply-chain compromise inside another supply chain: the PDF editor vendor's own systems were not the point of compromise, but its installer depended on a software partner that supplied additional font packages during setup.

Attackers recreated the partner's package infrastructure on a server they controlled, copied the legitimate MSI font packages, and modified one Asian-font MSI. An unspecified weakness let them influence the download parameters used by the PDF editor installer, so the legitimate installer reached the attacker-controlled replica server for that package. Comodo later identified the visible application as PDFescape Desktop and described the package as pdfescape-desktop-Asian-and-extended-font-pack.msi. The malicious MSI dropped xbox-service.exe into System32, ran a DLL disguised as setup.log through rundll32, and launched a Monero miner under the cover of a normal PDFescape installation.

The payload also tried to modify the Windows hosts file to block update or remediation traffic for PDF-related applications and security software. Microsoft saw evidence that the campaign was active between January and March 2018, affected only a handful of observed machines, and was automatically remediated for Windows Defender ATP customers.

The trust boundary is the point. Users did not install a fake PDF editor from an obvious clone site. They ran a legitimate PDFescape installer, and a second-tier package dependency inside that setup flow delivered the miner.