S5Mark is a 'VPN' that is actually a rootkit in disguise, BitDefender says

The best defense, as always, is constant vigilance against what you're downloading, and from where.

Credit: Bitdefender

While a form of the Zacinlo rootkit has been active for several years, BitDefender said Monday that it has adopted a more sinister appearance: as an anonymous "VPN" service, S5Mark, that worms its way into Windows 10 systems and can send screenshots of whatever you're looking at to its control server.

While it's not clear how many systems have been infected in the wild, Bitdefender says that the majority of Zacinlo systems that have been attacked have been in the United States, and running Windows 10. Check out PCWorld's roundup of the best VPNs before downloading an untested version from a shady part of the web.

In a report (PDF), Bitdefender said that the platform has been active for several years, usually tagging along on freeware programs that might claim to improve the performance of your browser, for example. But the longevity of the malware has allowed its developers to quietly give it extraordinary powers over your PC, including:

  • "man-in-the-browser" capabilities that intercept and decrypt SSL communications, allowing it to inject custom Javascript into webpages the victim visits;
  • the ability to redirect pages within browsers, and quietly load other pages in hidden background windows;
  • inject its own ads;
  • the ability to take screenshots, then send them up to its command-and-control server;
  • the ability to detect and disable third-party antimalware solutions, including Windows Defender;
  • and the ability to conceal itself by copying encrypted versions of itself across your PC.

Zacinlo also contains sophisticated abilities to update itself and receive instructions from its command server to turn off services within your PC, Bitdefender said. The firm cited its "extremely configurable and highly modular design" that could be used to adapt Zacinlo in the future to something even more pernicious.

That's important, because Zacinlo appears to have evolved from a foundation of click fraud, where ads are injected and "interacted with" for the benefit of securing payments from online ad agencies. The behind-the-scenes ads that Zacinlo downloads can do exactly that. 

The fact that Zacinlo is now being distributed via the false S5Mark VPN, though, preys upon the user's belief that the product can be used to secure activities like online banking. Downloading the VPN (which does nothing, besides show a fake UI which appears to show an active VPN application) loads a "dropper" that begins quietly downloading and installing the rest of the malware.

Interestingly, BitDefender doesn't seem to be claiming that the company can block Zacinlo from being installed. (In case of an infection, however, the company says that you can kick off a system scan using Bitdefender's Rescue Mode to remove the rootkit and the adware components.) 

What you can do to stop it: The best defense, of course, is simply to take precautions about where you (or your kids!) download software from. "For more than a decade, adware has helped software creators earn money while bringing free applications to the masses," BitDefender senior e-threat analyst Bogdan Botezatu wrote. "Headliner games and applications have become widely available to computer and mobile users the world over, with no financial strings attached."

As Heinlein wrote, though, there ain't no such thing as a free lunch. Malware like Zacinlo may accompany otherwise "free" games and apps. 

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Mark Hachman

Mark Hachman

PC World (US online)
Show Comments

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers


This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang


It really doesn’t get more “gaming laptop” than this.

Jack Jeffries


As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr


The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?