STORESOCKS Campaign Uses Trojanized Microsoft Store Apps to Turn Hosts Into Proxies
Summary
STORESOCKS distributes signed, trojanized Microsoft Store utilities that install a Go proxy with startup persistence. The campaign remained active in June 2026, using infected hosts for encrypted TCP and UDP relays.
Key points
- The campaign has operated since at least October 2025 and had four armed Store apps live across two seller accounts on June 27, 2026.
- The apps impersonate utilities such as disk analyzers, screenshot tools, cleaners, and auto-clickers; each includes a functional Electron interface.
- A Node FFI bridge loads a bundled Go DLL, which registers the host with helper infrastructure and enables encrypted TCP and UDP proxy relays.
- MSIX startup tasks launch the app headlessly at logon using the -start argument.
- The June 2026 payloads use telemetry.dll or lib3Z7.dll and are about 68 MB, packaged in a larger Go build associated with Gogs.
- Hexastrike attributes the operation to an unknown actor and assesses it as proxy-infrastructure monetization, not targeted espionage.
- Defenders should correlate Store package installs, startup tasks, native DLL loads, and helper or relay traffic; the article recommends restricting and reviewing unfamiliar Store utilities.
Article Details
- Attack Vectors
- Trojanized utility applications are delivered as validly signed MSIX packages through the Microsoft Store.
- The Electron application uses a Node FFI bridge to load a bundled native Go proxy DLL.
- An MSIX windows.startupTask runs the application headlessly at logon with the -start argument.
- The proxy registers the victim host with helper infrastructure, then uses encrypted relay sessions to proxy TCP and UDP traffic.
- Defensive Notes
- Review newly installed Store utility applications, especially those from unfamiliar publishers that combine full-trust execution with package-declared startup tasks.
- Correlate Store package installation and logon startup with native DLL loads from the package directory and JavaScript-to-native loading through Node FFI.
- Inspect package manifests, Electron archives, bundled DLLs, and WindowsApps activity; preserve these artifacts before removing a suspected package.
- Block the listed campaign helper and relay infrastructure, and review outbound activity from installation through removal, including unusual third-party egress after helper contact.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | api1[.]checkupdatesnow[.]xyz | Store wave 2 helper infrastructure. |
| DOMAIN | api1[.]mylabubus[.]shop | Store wave 1 helper infrastructure. |
| DOMAIN | api2[.]checkupdatesnow[.]xyz | Store wave 2 helper infrastructure. |
| DOMAIN | api2[.]mylabubus[.]shop | Store wave 1 helper infrastructure. |
| DOMAIN | gate1[.]storetelemetryapiapps[.]xyz | Live June 2026 helper registration endpoint. |
| DOMAIN | helper[.]labubusmarket[.]com | 2025 campaign helper infrastructure. |
| DOMAIN | mylabubus[.]shop | Store wave 1 campaign infrastructure. |
| DOMAIN | relay[.]labubusmarket[.]com | 2025 campaign relay infrastructure. |
| DOMAIN | storetelemetryapi[.]xyz | Live June 2026 helper infrastructure used for proxy registration. |
| DOMAIN | storetelemetryapiapps[.]xyz | Live June 2026 helper-related infrastructure. |
| DOMAIN | telemetrystoreapi1[.]xyz | Live June 2026 helper infrastructure. |
| IPV4 | 144[.]124[.]254[.]145 | Earlier campaign infrastructure. |
| IPV4 | 146[.]103[.]110[.]251 | Earlier campaign infrastructure. |
| IPV4 | 147[.]45[.]221[.]28 | Infrastructure associated with checkupdatesnow.xyz. |
| IPV4 | 147[.]45[.]221[.]29 | Infrastructure associated with mylabubus.shop. |
| IPV4 | 178[.]250[.]187[.]243 | Helper infrastructure associated with helper.labubusmarket.com. |
| IPV4 | 185[.]218[.]137[.]62 | Relay infrastructure associated with relay.labubusmarket.com. |
| IPV4 | 2[.]26[.]26[.]139 | Live June 2026 helper infrastructure. |
| IPV4 | 89[.]124[.]124[.]112 | Earlier campaign infrastructure. |
| IPV4 | 91[.]84[.]106[.]129 | Infrastructure related to mylabubus.shop. |
| SHA256 | 09049e365c86e0bc6192fb1601d0fbe6bf2235f9f3e26ea1c83e26f41d041530 | Hash of a client.dll payload from an older Store wave. |
| SHA256 | 27870854b9e85265e21d06a4b9e696093c1558c1480e36a42540943d66f7a3ec | Hash of the May 2026 x86 client.dll payload. |
| SHA256 | 54a79692f3406c9fdf5ad4d090e6593a8906fcd6620c1ecf2f22c7390b577b78 | Hash of the May 2026 x64 client.dll payload. |
| SHA256 | 94182f6ad0ed5e1f02ffe646d5cef1ad161de43924656000478e1359de230438 | Hash of the telemetry.dll Memory Cleaner payload. |
| SHA256 | 9ce75ad965ab67de4db57f41340bd4acef232d0401da18e0652f34612ce2c8b3 | Hash of the lib3Z7.dll payload from SOFTWARE MARKETPLACE packages. |
| SHA256 | a094293b06e43060eb93d31237a931d26756df18f7e0ec5f2b762d7672bb08c6 | Hash of the telemetry.dll Auto Clicker payload. |
| URL | hxxps[:]//gate1[.]storetelemetryapiapps[.]xyz/register | Helper registration URL configured in the live proxy loader. |
| URL | hxxps[:]//storetelemetryapi[.]xyz/register | Helper registration URL configured in the live proxy loader. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationLive payloads were renamed, size-inflated, and re-hosted inside a larger Gogs-based build to obscure provenance.T1036.005 · Match Legitimate Resource Name or LocationThe applications impersonated familiar utility tools using plausible Store branding.T1071.001 · Web ProtocolsHTTPS was used for helper registration and ping communication.T1082 · System Information DiscoveryThe implant registered machine ID and build metadata with helper infrastructure.T1090 · ProxyThe infected host was enrolled as a TCP and UDP proxy node through relay infrastructure.T1106 · Native APIThe Electron loader used Node FFI to call exported functions in the native DLL.T1195.002 · Compromise Software Supply ChainTrojanized utility applications were delivered through the trusted Microsoft Store distribution channel.T1204.002 · Malicious FileUsers installed and launched the trojanized Store applications.T1547 · Boot or Logon Autostart ExecutionAn MSIX windows.startupTask launched the application with -start at logon.T1573.002 · Asymmetric CryptographyEarlier analyzed samples used TLS for relay sessions.T1583.001 · DomainsThe article identifies actor-controlled domains used for helper and relay infrastructure.
Vendors
Products
ElectronEach analyzed Store package contains a working Electron-based utility interface that matches the advertised purpose of the application.GogsHexastrike assesses that the live payloads contain the same backconnect module re-hosted inside a larger Go application tree associated with Gogs, an open-source Git service.Microsoft StoreHexastrike uncovered an ongoing backconnect proxy campaign distributed through trojanized Microsoft Store applications.MSIXThe applications are packaged as MSIX and are validly signed through Microsoft’s Store signing pipeline.