Compromised Chromium Extensions Push Malware Through Fake Critical Update Alerts
Users of Chromium-based browsers have reported intrusive pop-up notifications claiming that a Critical Update Required or Update available must be installed immediately. These messages appear while browsing regular websites and, when clicked, deliver either a VBS script or an EXE file that the user must run manually.
The problem affects not only Chrome but also Brave and Opera, with the fake alerts incorrectly suggesting an update for Google Chrome. The inconsistency in the update text quickly reveals the deception to attentive users.
The source of the malicious windows is compromised browser extensions that fetch harmful scripts from external servers at runtime. Because the dangerous code is not stored inside the extension package itself, conventional antivirus scans frequently return clean results until the user interacts with the prompt.
Earlier campaigns were linked to the extension QuickLens — Search Screen with Google Lens, which was later removed from the Chrome Web Store. Recent reports point to Enable Right Click & Copy Smart Unlock + OCR and other small utilities that remain available, some with tens of thousands of installations and high user ratings.
Attackers typically obtain control by purchasing a popular legitimate extension or compromising the developer account, after which they publish an update containing the new malicious behavior. Security researchers advise users never to download or execute files offered through such pop-ups and to check for genuine browser updates only via the built-in settings menu.
Related articles
Malinsure Cybercrime Group Deploys SafeMostSSH Backdoor via Phishing Lures Mimicking Russian Insurance Updates
Researchers from F6 identified a previously unknown cybercrime cluster named Malinsure that has been active since at least July 2026. The group distributes phishing emails containing PDF lures themed around voluntary medical insurance (DMS) discounts and updates from Russian insurance companies. Victims are tricked into downloading RAR or ZIP archives that abuse legitimate Microsoft binaries such as winword.exe and powerpnt.exe through DLL side-loading to execute the custom SafeMostSSH backdoor. The malware establishes a persistent reverse SSH tunnel to attacker-controlled servers and retrieves fresh C2 addresses from public posts on vc.ru by decoding fake PNG links. Additional delivery vectors include HTML and SHTML files that decode and drop archives containing the same payload components. Targets appear to include insurance, finance, and fuel-energy sector organizations, with infrastructure also referencing gosuslugi.email and minfin.support domains.
Palo Alto Networks Unit 42 Uncovers Kimwolf v7 Botnet Infecting Android Set-Top Boxes via Open ADB
Researchers at Palo Alto Networks Unit 42 have identified Kimwolf v7, an updated botnet that compromises Android set-top boxes and other IoT devices to conduct DDoS attacks. The malware now employs HTTP/2 flooding with realistic browser fingerprints to blend malicious traffic with legitimate user activity. Command-and-control infrastructure is hardened through Ethereum Name Service lookups and public Ethereum RPC services, with a Tor fallback address embedded in the binary. Operators have removed scanning, exploitation, and brute-force capabilities from this version, indicating a division of labor where a separate loader handles initial infection. The botnet uses 15 numbered methods focused on high-performance UDP floods optimized for ARM processors. Infections typically occur through residential proxies targeting devices with open Android Debug Bridge on port 5555, after which the malware masquerades as system processes. Unit 42 advises treating Android set-top boxes as untrusted devices and disabling ADB or restricting it to USB access only.
Google Play Apps Hide Anatsa Banking Trojan Using Stealthy Loaders
Malicious applications distributed through Google Play are employing stealthy loaders to install the Anatsa banking trojan for Android, putting victims' financial accounts at risk. The campaign relies on seemingly legitimate programs to conceal the initial infection stage, with one identified case involving a modified PDF reader that displays a fake update prompt to trick users into installing an additional component. Another loader discovered in the Cleanova application collects data from analytics SDKs, including installation source details, and forwards this information to a command-and-control server. The server then decides whether to deliver the malicious payload based on predefined criteria, leaving the code inactive for non-targeted victims to evade automated analysis. Once Anatsa is installed, the threat can facilitate theft of credentials used for financial services and enable fraudulent transactions. Banking trojans represented 30.77 percent of detected malicious mobile applications in the second quarter of 2026, during which more than 1.99 million attacks involving malware, adware, or unwanted programs were blocked and 93,574 banking trojan installation packages were identified.
Android Banking Trojans Hide in Droppers to Bypass Google Play Checks
Kaspersky solutions blocked 1.99 million attacks involving Android malware, adware and potentially unwanted programs in the second quarter of 2026, down from 2.68 million the previous quarter. Researchers still recorded 304,000 malicious installation packages, among them 93,600 banking trojans that retained the largest share at 30.77 percent. Operators increasingly rely on droppers that pass initial store review and later download the real payload. One PDF reader application distributed through Google Play displayed a fake update prompt that installed the Anatsa banking trojan. The Cleanova dropper collected installation-source data and delivered its payload only under attacker-chosen conditions, avoiding analysis environments. The share of users hit by Trojan-Dropper.AndroidOS.Banker.dd rose sharply from 0.01 percent to 2.16 percent, while the Mamont and Creduz families continued to expand with new variants.