EITest: Hoefler Text Popups Targeting Google Chrome Users Now Push RAT Malware
Summary: The EITest campaign revived its fake HoeflerText popup in late August 2017, this time delivering a file downloader named Font_Chrome.exe that pulls follow-up malware installing the NetSupport Manager remote access tool on Windows hosts. Unit 42 notes the popups had previously pushed ransomware such as Spora and Mole, and that Chrome users see the fake font prompt while Internet Explorer users get a tech support scam alert instead.
Why it matters: Unit 42 found the infected host running NetSupport Manager version 11.00, and because it is a RAT, infected users will probably notice no change in day-to-day computer use - the compromise runs quietly on a legitimate commercial tool.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026