The Fake Browser Update Scam Gets a Makeover
Summary: The ClearFake scam, first documented by researcher Randy McEoin in August 2023, uses hacked WordPress sites to show visitors browser-specific update prompts that drop an information-stealing trojan. Guardio researchers found the group moved its malicious files from Cloudflare, after those accounts were blocked, to smart contracts on the Binance Smart Chain, where a compromised site queries the contract and receives an obfuscated payload.
Why it matters: Guardio's Nati Tal describes the blockchain retrieval as a free, untracked way to serve the payload without leaving traces, and Proofpoint says at least four distinct threat actor groups now use fake browser updates - a technique the core group has run for five years.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026