Loading story…
Attackers used compromised websites, especially WordPress installations, to display counterfeit browser and software update pages that tricked visitors into downloading malware. Researchers documented multiple variants of the tactic, including FakeUpdateRU, which replaced site files with a fake Google Chrome download page and distributed ZIP payloads tied to Zgrat and RedLine Stealer, and FakeSG, which injected JavaScript to serve browser-specific update lures that ultimately installed NetSupport RAT. In another related campaign, malicious code hidden in CSS through steganographic obfuscation reconstructed JavaScript that showed a fake Flash Player update and led victims to HTA/VBScript downloaders and PowerShell-based malware retrieval.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Sucuri described FakeUpdateRU as a widespread campaign compromising WordPress and other CMS sites to replace content with a fake Google Chrome update page. The campaign delivered ZIP archives linked by other researchers to Zgrat and RedLine Stealer, and attackers adapted after Google blocked many redirect domains.
Sucuri reported that intermediary domains used in the FakeUpdateRU delivery chain had all been registered within the prior two weeks. These chromium-themed domains were used to redirect victims from fake Chrome update pages to malware payloads.
Malwarebytes documented FakeSG as a distinct fake browser update campaign that mimicked SocGholish-style lures on hacked WordPress sites. The campaign used browser-specific templates and delivered NetSupport RAT through ZIP downloads or .url files that fetched obfuscated HTA payloads over WebDAV.
On June 22, AnFam17 observed a fake browser update campaign that leveraged Internet shortcut files as part of the delivery chain. Malwarebytes connected this activity to compromised WordPress sites and WebDAV-hosted HTA launchers delivering NetSupport RAT.
On June 5, SecurityAura described an unknown campaign using .hta payloads disguised as driver updates. Malwarebytes later cited this as related background to the broader fake-update activity around FakeSG.
Sucuri reported a campaign that hid malicious JavaScript in a CSS file fetched from polobear[.]shop, then displayed a fake Flash Player update lure from lopiax[.]us. The resulting ZIP/HTA/VBScript chain used PowerShell to download additional malware, including NetSupport RAT.
An archive named GeoIP.dat (1).zip was first uploaded to polobear[.]shop and contained scripts implementing a fake Flash Player update attack with bot, user-agent, and geographic filtering. The files suggested the operators were building reusable infrastructure for broad victim targeting.
The domain polobear[.]shop, later used to host a CSS-based steganographic malware delivery toolkit and related server-side components, was registered on this date. Sucuri linked it to fake Flash update activity that ultimately delivered malware including NetSupport RAT.
Hacked Steam accounts sent chat spam linking users to videomeo.pw, where a bogus Flash Player update executed a PowerShell-based infection chain. The final payload was a renamed NetSupport Manager client that connected to a NetSupport gateway for remote control.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
blog.sucuri.net
Open sourcemalwarebytes.com
Open sourceblog.sucuri.net
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported continued abuse of **fake browser and software update pages** on compromised websites to trick Windows users into installing malware, with multiple investigations tying the lure to delivery of **NetSupport Manager RAT** and broader **SocGholish/FakeUpdates** activity. Trellix described a campaign in which injected JavaScript redirected visitors to counterfeit Chrome update pages, then launched a staged infection chain using JavaScript, batch files, VBScript, `curl`, and a portable **7-Zip** utility to install NetSupport while avoiding PowerShell. Mandiant documented a similar chain in which a disguised archive and scripts unpacked NetSupport from `%AppData%`, established persistence through startup shortcuts and registry artifacts, and enabled remote desktop control, file transfer, system inventory, application launch, and geolocation.
Aug 15, 2026
Trellix researchers reported new fake browser update techniques being used to infect victims with **NetSupport RAT**, a remote access trojan commonly deployed through social engineering. The activity relies on fraudulent browser update prompts that impersonate legitimate software notices, tricking users into downloading and executing malware under the guise of routine updates. The reported infection chains show attackers refining a long-running tactic with updated delivery methods designed to improve credibility and evade detection. Once installed, **NetSupport RAT** can provide remote control of compromised systems, enabling follow-on actions such as surveillance, payload delivery, and broader intrusion activity, underscoring the continued risk posed by fake update lures in enterprise environments.
Jul 12, 2026
Researchers reported multiple malware delivery campaigns using **malicious email**, **fake browser updates**, and likely **content injection** on compromised websites to install infostealers and remote access trojans. One campaign abused WordPress sites to present a fake **Google Chrome** update that delivered credential-stealing malware, while another used malicious **PEC** email lures tied to crypto-wallet themes to infect targets with remote access tooling and theft-focused payloads. Separate reporting also described spam operations distributing evasive malware through email, showing continued reliance on social engineering and web-based lures to gain initial access. The activity aligns with attacker use of **MITRE ATT&CK** techniques including `T1659` for content injection and `T1555` for stealing credentials from password stores. Once installed, these malware families commonly target saved passwords and account data from browsers, email clients, FTP/SFTP tools, Wi-Fi profiles, and Windows credential stores using utilities and methods associated with tools such as **LaZagne**, **Mimikatz**, **MailPassView**, and **Network Password Recovery**. The campaigns underscore a persistent threat pattern in which adversaries combine deceptive delivery methods with credential theft to expand access, move laterally, and compromise additional systems.
Aug 11, 2026