Trojan.BPlug.4268
Trojan.BPlug.4268 is the detection name used by Dr.Web for a malicious JavaScript component of the WinSafe browser extension. Its documented behavior is to display intrusive advertisements in web browsers. The malware was listed by Dr.Web among commonly detected threats in both Q4 2025 and Q1 2026, in the category of ad-displaying trojans. The available content does not provide additional confirmed details on infection vector beyond its association with the WinSafe browser extension, nor specific industries or platforms targeted, but its activity is clearly tied to browser-based ad display.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malicious JavaScript component of the WinSafe browser extension that injects or displays intrusive browser advertisements.
Malicious browser extension component that displays intrusive ads.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.