Cyber Wire: Hacking Humans #199
Summary: Red Canary researchers, in research written by Aedan Russell, documented ChromeLoader, a persistent browser hijacker that modifies browser settings and redirects users to advertising websites, with a Windows version that uses PowerShell and a Mac version that does not. The malware is distributed through downloads of pirated material such as movies and software.
What's compelling: ChromeLoader changes the default search engine to a lookalike page, so users who are not versed in these things see what appears to be a legitimate search page and keep using it - meaning the compromise persists quietly on the endpoint rather than announcing itself.
Read the original at GreyNoise Blog ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026