Google Ads fake document-app lures (AduelPaper, HaloDocket, LumenDocs) delivering the QuartzLine (CLOUDHAZE) backdoored PDF viewer

Search and display ads for invented free document apps (AduelPaper, HaloDocket, LumenDocs) that deliver QuartzLine, a working Windows PDF viewer with a hidden backdoor that runs commands for its operator and installs further malware (tracked by Mandiant as CLOUDHAZE). Active since at least July 2026. An ad shown on an unrelated website opens a one-page product site such as beatramiro[.]com, wolflingleader[.]com, purplepandagroup[.]com or weboughty[.]com. Its download button leads to a redirector on a second domain such as softwareslizards[.]com, zebrabrian[.]com or royalproductive[.]com, and from there to a short-lived link on an Amazon S3 bucket (duskhollow, flintvale, alberfine) that serves the installer. The app name on the page never matches the program that gets installed. The operator registers its domains in batches, parks them all at once when exposed, and blocks automated visitors soon after a site launches. A match means a page built from the lure template, or a scan of a campaign host.