Be careful – these browser updates could be fake to spread malware

Cybersecurity researchers at Gen Threat Labs have observed several websites spreading a malware called WarmCookie disguised as updates to popular software.

These websites were either created from scratch or were once legitimate and then eventually taken over, the experts found. However, they were all found to be sending visitors a false warning that various components of their computer were outdated and needed to be updated.

These were either their web browsers, Java, VMware Workstation, WebEx or Proton VPN – and visitors who fell for the trick and accepted the download were exposed to a backdoor called WarmCookie – a malware first discovered in mid-2023.

WarmCookie backdoor

The experts have warned that the malware can steal data and various files at the operator’s request, list programs through the Windows registry, execute arbitrary commands through CMD, take screenshots and drop additional payloads on the target endpoints.

In addition, WarmCookie can execute DLLs from the temporary folder and return the output, as well as transfer and execute EXE and PowerShell files.

Fake update attacks are nothing new – in fact, they are as old as the Internet itself and aim to trick visitors into thinking their computer is at risk. At the most basic level, the attack is nothing more than a pop-up.

The best way to defend against these attacks is to learn how most of these programs communicate with their users and how they are updated. Most browsers update automatically and never prompt their users to download and run an executable file. Other programs usually require the user to visit the official homepage and download a new installation file, which in most cases overwrites the existing installation. Installing an antivirus program also helps.

Over BleepingComputer

Recent Posts