Watch out - those browser updates could be a fake spreading malware
Victims are being targeted with some corny update scams
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Cybersecurity researchers from Gen Threat Labs have observed multiple websites distributing a piece ofmalwarecalled WarmCookie disguised as updates for popular softwarre.
These websites were either built from scratch, or were legitimate once and then taken over at some point, the experts noted, but were all seen serving a fake warning to the visitors, that different components of their computer were out of date and required updating.
These were either their web browsers, Java, VMware Workstation, WebEx, or Proton VPN - and visitors that fell for the trick and accepted the download were dropped a backdoor called WarmCookie - a piece of malware that was first spotted in mid-2023.
WarmCookie backdoor
The experts have warned the malware can steal data and different files, enumerate programs via the Windows Registry, run arbitrary command execution via CMD, grab screenshots, and drop additional payloads to the target endpoints, at the operator’s will.
What’s more, WarmCookie can run DLLs from the temp folder and send back the output, and transfer and execute EXE and PowerShell files.
Fake update attacks are nothing new - in fact, they are as old as the internet itself, and revolve around tricking the visitor into thinking their computer is at risk. At its most basic level, the attack is nothing more than a popup.
The best way to defend against these attacks is to learn how most of these programs communicate with their users, and how they are updated. Most browsers update automatically, and never ask their users to download and run an executable file. Other programs usually require the user to visit the official home page and download a new installation file which, most of the time, overwrites the existing installation. Also, having anantivirus programinstalled helps.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
ViaBleepingComputer
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
A new form of macOS malware is being used by devious North Korean hackers
Scammers are using fake copyright infringement claims to hack businesses
How to turn off Meta AI
