Malware

DigitalPulse

DigitalPulse is proxyware abused in proxyjacking campaigns to monetize victims’ internet bandwidth without consent. Reporting from AhnLab ASEC and related summaries describes it being installed by downloader malware such as DPLoader in campaigns attributed to Larva-25012, including malvertising and fake software download chains targeting users seeking freeware, cracked, or pirated software, with notable activity affecting Windows systems in South Korea. Delivery has included disguised installers such as fake AutoClicker and trojanized Notepad++ packages hosted on GitHub, using DLL side-loading, PowerShell staging, NodeJS- or Python-based DPLoader components, and Windows Task Scheduler persistence. In one campaign, ASEC assessed proxyware signed with the certificate name "Netlink Connect" to be identical to previously observed DigitalPulse. DigitalPulse has been described as an obfuscated Go-based program, and in some cases an injector DLL injects the payload into explorer.exe. Observed persistence and execution artifacts associated with DigitalPulse installation include DPLoader task "UNPScheduler," scheduled tasks such as "SyncTaskUpdatescheduler" running "syncupdates.dll" via Rundll32.exe, and a Python-chain variant that downloads a DLL to %LOCALAPPDATA%\Microsoft\Microsoft Windows Pluton[GUID]\MicrosoftWindowsPlutonTaskScheduler.dll and registers the task "MicrosoftWindowsPlutonTaskScheduler." LevelBlue reportedly linked a 2023 campaign installing DigitalPulse to at least 400,000 infected Windows systems. DigitalPulse is also mentioned alongside other abused proxyware families including Honeygain and Infatica.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1189Drive-by CompromiseEvidence1

“clicking on the webpage pops up an advertisement page. This page randomly redirects to various PUP, malware, or ad pages.”

Execution

2 techniques

T1053.005Scheduled TaskEvidence1

“registering it in the Task Scheduler… task registered under the name “FastDiskCleanup”… registers it in the Task Scheduler under the name “Network Performance”.”

T1059.001PowerShellEvidence1

“AutoClicker creates and executes a PowerShell script at the path “%TEMP%\t.ps1”… responsible for installing NodeJS as well as downloading malicious JavaScript and registering it in the Task Scheduler.”

Persistence

1 technique

T1053.005Scheduled TaskEvidence1

“registering it in the Task Scheduler… task registered under the name “FastDiskCleanup”… registers it in the Task Scheduler under the name “Network Performance”.”

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence1

“registering it in the Task Scheduler… task registered under the name “FastDiskCleanup”… registers it in the Task Scheduler under the name “Network Performance”.”

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

“it connects to a C&C server and sends basic system information. Later, it executes additional commands based on the response.”

T1105Ingress Tool TransferEvidence1

“downloads proxyware from GitHub to a path such as …\NTService.exe”

INDICATORS OF COMPROMISE

IOCs tracked for this family

13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

5 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app1 year ago

hash.md5●●●●●●●●●●●●View more in app1 year ago

uri●●●●●●●●●●●●View more in app1 year ago

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

cyber security newsNews

Jan 22, 2026

Proxyware Malware Disguised as Notepad++ Tool Leverages Windows Explorer Process to Hijack Systems

Proxyware payload used to monetize compromised hosts by routing third-party traffic through victim networks; described as an obfuscated Go-based program injected into explorer.exe.

security online infoNews

Jan 22, 2026

Bandwidth Bandits: Fake Notepad++ Installers Hide "Proxyjacking" Malware

Proxyware agent deployed to hijack and resell victim internet bandwidth as part of a proxyjacking scheme.

ahnlab asec blogNews

Jan 18, 2026

Proxyware Disguised as Notepad++ Tool - ASEC

Proxyware payload (noted as an obfuscated Go implementation) delivered by DPLoader and injected into explorer.exe via an intermediate DLL injector, then used to monetize victim bandwidth by enabling proxy-sharing functionality.

the hacker newsNews

Sep 1, 2025

⚡ Weekly Recap: WhatsApp 0-Day, Docker Bug, Salesforce Breach, Fake CAPTCHAs, Spyware App & More

A proxyware program used to monetize infected hosts by reselling their network bandwidth/resources; mentioned in the context of fake YouTube downloader sites distributing proxyware.

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching13

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.