EV-Signed Video Downloader Hides MSSQL Backdoor, Hits Zero AV Detections
Five executables distributed under the PPTube and iTubeGo brands passed every antivirus engine on VirusTotal while carrying a Skip-2.0 SQL Server authentication-bypass implant. A single Sectigo Extended Validation certificate issued to 'ByteHub Technology Inc' provided the trust anchor, and it remains valid until February 2028.
Five Windows executables distributed under two consumer software brands — PPTube and iTubeGo YouTube Downloader Pro — arrived on VirusTotal between June 3 and June 6, 2026, each bearing a validly verified Sectigo Extended Validation code-signing certificate issued to an entity called "ByteHub Technology Inc." Every antivirus engine on the platform returned a clean verdict.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read