AhnLab found that a South Korean construction association website was serving trojanized security installers during the login process, exposing users who installed NX_PRNMAN or earlier TrustPKI packages. The modified installers were signed with a valid D2Innovation certificate, were uploaded only during certain time windows, and AhnLab counted more than 3,000 infections from the samples it obtained. The payload set included TrollAgent, a Go-based DLL infostealer run through rundll32.exe, along with related backdoors that resemble malware previously tied to Kimsuky activity. TrollAgent steals system data, browser credentials, cookies, bookmarks, history, extensions, and other local information, then communicates with C2 servers hosted under multiple p-e.kr, kro.kr, and co.kr domains.