TA2727

TA2727 is a financially motivated cybercriminal threat actor identified by Proofpoint as part of the growing web-inject and fake browser update ecosystem. The actor uses compromised legitimate websites and scam update alerts to distribute malware, and has been observed collaborating with TA2726, a malicious traffic distribution service operator that redirects victims by geography and device type. Proofpoint assessed with high confidence that TA2726 serves traffic for TA2727, including Keitaro TDS-based chains. TA2727 has been observed using fake update lures and JavaScript injects similar to SocGholish-style activity, but distributing its own payloads rather than TA569/SocGholish malware. Reported payloads attributed to TA2727 include Lumma Stealer and DeerStealer for Windows, Marcher for Android, and FrigidStealer for macOS. In observed campaigns, Windows users were prompted to download an MSI from a fake browser update page; the MSI installed a legitimate signed application together with a trojanized DLL that side-loaded DOILoader, which then executed Lumma Stealer. Android users received the same fake update lure but were delivered Marcher. macOS users outside North America were redirected to fake update pages that downloaded browser-themed DMG files delivering FrigidStealer. Proofpoint first designated TA2727 during an early January 2025 campaign that delivered different payloads based on recipient geography. In 2025, TA2726 redirected North American traffic to TA569/SocGholish and traffic from other countries to TA2727. Proofpoint also observed a late January 2025 campaign adding the macOS payload FrigidStealer. TA2727 has been described as distributing malware for Windows, Android, and macOS and as being identifiable by its use of legitimate websites to send scam update alerts. Known infrastructure mentioned in the reporting includes deski[.]fastcloudcdn[.]com, cloudfasterapp[.]com, and fastcloudcdn[.]com. TA2727 is also linked in reporting to FrigidStealer delivery chains such as TA2726 -> TA2727 ClickFix -> FrigidStealer. The reporting characterizes TA2727 as a copycat actor in the broader fake-update/web-inject ecosystem that emerged alongside other clusters beginning in 2023. No additional aliases or nation-state attribution are provided in the source content.