Bright Data's EarnApp Signing Chain Split to Smuggle a Stealer

A Windows installer that presents itself as EarnApp — Bright Data Ltd's consumer bandwidth-sharing client — is circulating in at least three variants that all carry a valid Bright Data Ltd code-signing chain anchored to DigiCert. Two of those variants read clean or undetected. The third, a component named net_updater32.exe dropped inside the same Program Files\EarnApp path, is classified by the C2AE sandbox as a stealer, with the malware family tag PBot attached at 50% confidence.