PDFSupernova: Tel Aviv-Signed Credential Harvester Hiding in Plain Sight

NOTE: The Trivolead attribution and the association of several "YAPA's" came from Luke Acha's analysis; The redirect chain and IOCs are from my independent captures during a live IR scenario. Remediation steps are my own. Our research features differing IOCs, possibly due to installation location or date/time of installation. I recommend reviewing his work alongside this article if you are attempting IR on PDFSupernova, and use both write-ups to inform capturing your own IOCs.

A browser hijacker landed on a workstation. The initial read: nuisance-level adware, probably sourced from downloading a free PDF tool. Fifteen minutes of triage later, the picture was significantly uglier — An OS-level Chrome profile swap, and embedded targeting for financial credentials. This is a write-up of what I found and how I cleaned it.

Initial Symptoms

Every Google search from Chrome auto-redirected through a chain ending at Yahoo. The redirect wasn't a browser extension — removing all extensions didn't fix it. The profile felt wrong: saved passwords behaved oddly, and the default search engine couldn't be overridden through Chrome settings. Even restoring to default Chrome settings did not change anything. Deleting the Chrome profile resolved it immediately, which told me the infection lived inside the profile directory rather than in a system-level persistence mechanism.

What PDFSupernova Actually Does

PDFSupernova is a deliberate credential harvester. The installer presents a clean loading UI that takes full-screen focus. This is a technique to prevent the user from seeing what's happening underneath.

While the loading screen is up, the installer:

1. 01Kills the running Chrome process
2. 02Stages a pre-built replacement Web Data SQLite file in %LOCALAPPDATA%\Temp
3. 03Overwrites Chrome's actual Web Data file in the user's AppData profile
4. 04Relaunches Chrome against the poisoned profile

The replacement Web Data file is the payload. It contains keyword filter entries pointing all searches through van.vanmirop.com, and — more importantly — pre-loaded form-fill autofill entries that specifically target banking and financial credential login fields. This isn't opportunistic; someone manually curated those form targets.

The Redirect Chain

Once installed, every search routes through a multi-hop redirect chain before landing on a legitimate search engine to avoid raising suspicion. Here is what my discovery process revealed:

search query
  → withgoogle.com
  → van.vanmirop.com
  → eusrchrdr.com
  → undertone.com
  → cdn.searchontec.com
  → [Yahoo results]

The hops exist to collect search query data. The end-user sees Yahoo results and may assume nothing is wrong. Meanwhile, the financial form-fill targeting is operating silently against any banking site the user visits.

Attribution: Trivolead LTD

As per Acha and a Hybrid Analysis sample, the installer binary is signed by a code-signing certificate issued to Trivolead LTD, a company registered in Tel Aviv. In my environment, the signature was valid at time of infection and passed basic Windows trust chain verification — which is why it wasn't blocked by default AV at the time of initial analysis.

Again, as per Acha, the same entity has been linked to a family of related hijackers: PDFParade, and PDFRogger — all sharing infrastructure and the same Web Data swap technique. More advanced variants, PrimePDFConvert and PDFChampion,, go further:

• !PrimePDFConvert drops a scheduled task for daily persistence pointing to an executable in C:\ProgramData\
• !As per Malasada Tech, PDFChampion acts as a remotely-controlled .NET malware loader using Roslyn-powered code execution (compile-and-run at runtime)

IOCs

The IOCs below were captured and stitched together using analysis of a fresh ANYRUN sandbox run, an existing Hybrid Analysis run, and independent proxy logs.

Remediation Steps

1. 01Delete the affected Chrome profile entirely. Do not attempt to repair the Web Data file — it will re-poison the profile on next update.
2. 02Clean the temp directory. Check %LOCALAPPDATA%\Temp for residual staged files. Look for folders containing a Web Data file with no corresponding Chrome install path. Also look for the PDFSuperNova folder under %APPDATA%
3. 03Audit scheduled tasks. Open Task Scheduler and look for any task pointing to executables under C:\ProgramData\ or %APPDATA%\ with names that don't match known software.
4. 04Check all Chromium-based browsers. Edge, Brave, Opera all store a Web Data file in their respective profile directories. Each one needs to be checked.
5. 05Block associated domains at your perimeter. Add the domains above to your firewall or DNS blocklist.
6. 06Run your detection and response software, like MalwareBytes, across the machine. Even if your preferred tool missed the initial install, post-infection behavioral analysis may catch persistence artifacts the signature didn't.