
image credit: unsplash
The Purple Fox rootkit is being spread as an installer for the popular Telegram instant messaging app for Windows, according to researchers.
It’s not clear how the installer in this case was distributed, although it seems like at least some were delivered via email. Common distribution methods for this type of installer are phishing campaigns, forum spam, YouTube posts and comments, as well as untrustworthy software download sites. We’ve also seen the same malicious downloader in a combination with a WhatsApp for Windows installer.