PDFChampions a YAPA Browser Hijacker, delivered via ads, that changes the browsers default search engine nearly FUD on VT

Khushal

Level 13
Thread author
Verified
Top Poster
Well-known
Apr 4, 2024
601
3,614
1,169
First seen on 9th August on VT, the malware still has only 5 detections on VT
 
Screenshot_11-11-2025_101045_bdaafgjhhjkdplpffldcncdignokfkbo.jpeg
Screenshot_11-11-2025_101115_pdfchampions.com.jpeg
 
First seen on 9th August on VT, the malware still has only 5 detections on VT
K7 detected as Susp.
 
This is the legitimate pdf editor website (with no "s")

Nice catch. Like some of your other threads where one letter, number can make all the difference. Including the one email? where a r was added to a n to make a m = rn.

Even F-Secure blocked it.
Screenshot 2025-11-11 084400.png
 
First seen on 9th August on VT, the malware still has only 5 detections on VT
@Captain Awesome
No; that one 👆