Executive Summary
Researchers have identified a sophisticated malware campaign dubbed 'NinjaMare' that utilizes a remote input injection engine to control Windows systems. The attack begins with typosquatting and malvertising, leading victims to a fraudulent 'privacy browser' landing page. The malware is distributed via MSIX installers, which often bypass traditional EDR detections and maintain a near-zero detection rate on VirusTotal.
Technically, the malware is built using the NW.js framework with custom C++ extensions that enable synthetic keyboard and mouse input. It employs advanced evasion techniques, including a 12-hour delayed execution 'birthday' gate, geolocation targeting (Tier 1 countries like the US, UK, and Germany), and a requirement for seven minutes of system idle time before moving browser windows off-screen to perform malicious actions.
This campaign represents a significant risk because the injection engine is generic enough to drive any application on the host, such as spawning PowerShell to execute further payloads. Traces found in the malware's build artifacts link this operator to a decade-old activity chain, including 'whatsappTime' and other 'Time' themed applications dating back to 2016.