Loading malware…
Net Guard is Windows browser-hijacking malware marketed as a Wi-Fi and DNS safety scanner. It is distributed through fake security-check landing pages reached from typosquatted domains impersonating popular AI services, including Claude, DeepSeek, Copilot, and ElevenLabs. The delivered installer matches the Microsoft Store package published by Myflixly App and carries a Microsoft Marketplace signature; this provenance does not prevent its malicious browser-control behavior.
Built with Tauri, Net Guard uses the shared buntai-sdk module and remote configuration to control browser settings. It can change Chrome and Firefox search settings through UI automation and synthetic input while the user is idle, modify browser profiles, install arbitrary Chrome extensions, and execute remotely supplied JavaScript through browser DevTools. Its browser-control features are enabled by default, and its onboarding enables browser synchronization after a countdown without disclosing the browser changes.
Net Guard runs at startup with full trust and checks for debuggers and enterprise browser management. It shares browser-hijacking code with Privacy Keeper and MyFlixly Browser. Its distribution forms part of the TypoPrompting delivery pattern, which exploits mistyped AI-service addresses to steer visitors toward deceptive verification and installation flows.
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.