SilentMare and HollowMare Malware Families Spread via Google Ads

Research has identified two distinct malware families, SilentMare and HollowMare, targeting enterprise and home users through trojanized utility software. These applications, often promoted as PDF or ZIP tools via Google Search Ads, serve as vehicles for persistent access or browser modification. While the applications may provide nominal functionality, they exfiltrate user documents to remote servers for processing, exposing sensitive data to untrusted third parties.

SilentMare functions as a sophisticated downloader and beachhead, characterized by its use of varying programming languages (C#, Rust, F#, Python) across different generations to evade detection. It establishes persistence via scheduled tasks and executes encrypted .NET payloads directly in memory. HollowMare, categorized as a Potentially Unwanted Application (PUA), focus on browser hijacking by force-installing extensions or modifying search engine configurations through synthetic keystroke injection and profile file manipulation.

Infrastructure analysis reveals significant overlaps between the two families, including shared response-header hashes and code-signing certificates issued to Israeli entities. These findings suggest a shared supply chain for malware development or distribution infrastructure. Organizations are advised to block these unauthorized utilities, as they represent a bridge for more severe subsequent compromises.