There is a file on some Korean PCs at C:\Program Files\microsoft\copilot\services\copilotservice.exe. It is not Microsoft's, it has nothing to do with Copilot, and its job is to quietly rent out the machine's internet connection to strangers.
AhnLab's Security Intelligence Center says the crew it tracks as Larva-25012 has spent the second half of 2026 pushing proxyware onto already-compromised systems. Proxyware is legitimate software in the right hands: you install it, it shares some of your bandwidth with paying customers, and you get a small cut. Installed without you, it is theft of your connection, and the money goes to somebody else. It is the same business model as cryptomining malware, just billing bandwidth instead of electricity.
No new victims required
The interesting part of ASEC's report is what the group isn't doing. It hasn't built a new delivery chain. Instead it reaches back into machines it already owns, through a loader called DPLoader planted in earlier campaigns and left running.
DPLoader is obfuscated JavaScript, kept alive by a scheduled task that runs it through a Node.js install the original infection put there. It phones home with basic system information and waits. When the server answers with a PowerShell command, it runs it. Every command ASEC observed did the same thing: install proxyware.
Four brands, four innocuous task names
Over the recent wave the group has cycled through four proxyware products, each installed by a near-identical one-line PowerShell download and registered as a scheduled task named to survive a glance at the task list:
- DigitalPulse, installed as plutonagent.exe under a task called PlutonAgentScheduler. The installing script also runs commands to switch Microsoft Defender off.
- SOAX, under EnterpriseMgmtServicesScheduler, dropped as an SDK library that a small loader calls into with the attacker's own account token, from either C:\Program Files\deephour or that fake Copilot directory.
- Appsalt, under SecurityHealthServiceSyncUpdate, planted in C:\Program Files\microsoft\servicing.
- IPRoyal, the most recent, under the wonderfully bureaucratic BackgroundTaskRegistrationMaintenanceTaskScheduler.
The token detail matters. These services hand out an SDK so developers can bundle bandwidth sharing into their own apps, and the token is what routes the payment. The attacker isn't stealing the proxyware companies' software so much as signing your machine up under their own account.
Where the infections came from originally
ASEC has watched Larva-25012 since at least 2025. Earlier rounds arrived through pop-up ads on free YouTube download sites, through GitHub, where the proxyware was dressed up as a Steam client cleanup tool, and in early 2026 through pages offering cracked software. That last channel is the one that keeps producing: IntelFusions covered a separate campaign in September that turned Korean PCs into proxies and VPN exit nodes by the same general route, and residential proxy networks built this way are increasingly assembled out of ordinary consumer devices. ASEC says systems in South Korea are heavily represented among the targets.
Check your scheduled tasks and your Defender status
For defenders, the tell is not the payload, which is commercial software with a valid purpose. It is the placement. Look for scheduled tasks running obfuscated JavaScript through Node.js, for executables sitting in Microsoft-branded folders under C:\Program Files that Microsoft never shipped, and for Defender having been disabled by something other than an administrator. Any machine that already ran a crack or a download-site installer should be treated as still compromised, because that is precisely the population this campaign is harvesting.
Indicators
- hxxps://d6nue5fz4t6y8[.]cloudfront[.]net/9083743654554665[.]ps1, the Appsalt installer script
- hxxps://d3mz24vhl6xvgp[.]cloudfront[.]net/CopilotService[.]exe and liblivenet_amd64[.]dll, the fake Copilot loader and SOAX library
- hxxps://7jb7qi6vnr5pa22a4br4irz3tu0yqzbd[.]lambda-url[.]us-east-1[.]on[.]aws/e, the SOAX reporting endpoint
- Scheduled tasks named PlutonAgentScheduler, EnterpriseMgmtServicesScheduler, SecurityHealthServiceSyncUpdate and BackgroundTaskRegistrationMaintenanceTaskScheduler
None of this will ever encrypt a file or pop a ransom note, which is exactly why it runs for months. The cost lands as a slow connection, a strange bill, and an address block that somebody else's fraud gets attributed to.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.