Loading malware…
Trojan.BPlug.4268 is the detection name used by Dr.Web for a malicious JavaScript component of the WinSafe browser extension. Its documented behavior is to display intrusive advertisements in web browsers. The malware is described as a browser-based ad-displaying trojan/component rather than a standalone payload. It was listed by Dr.Web among the most common threats detected on protected devices in Q4 2025, Q1 2026, and Q2 2026. The available content does not provide additional high-confidence details on infection vector beyond its association with the WinSafe browser extension, nor does it attribute the malware to a specific threat actor, industry targeting, or provide concrete IOCs such as hashes, domains, or file paths.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malicious JavaScript component of the WinSafe browser extension that displays intrusive advertisements in browsers.
Malicious JavaScript component of the WinSafe browser extension that injects or displays intrusive browser advertisements.
Malicious browser extension component that displays intrusive ads.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.