Loading story…
Trellix researchers reported new fake browser update techniques being used to infect victims with NetSupport RAT, a remote access trojan commonly deployed through social engineering. The activity relies on fraudulent browser update prompts that impersonate legitimate software notices, tricking users into downloading and executing malware under the guise of routine updates.
The reported infection chains show attackers refining a long-running tactic with updated delivery methods designed to improve credibility and evade detection. Once installed, NetSupport RAT can provide remote control of compromised systems, enabling follow-on actions such as surveillance, payload delivery, and broader intrusion activity, underscoring the continued risk posed by fake update lures in enterprise environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Trellix published research describing new fake browser update techniques used to deliver NetSupport RAT. The reference indicates the technical details were publicly disclosed in the blog post.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported continued abuse of **fake browser and software update pages** on compromised websites to trick Windows users into installing malware, with multiple investigations tying the lure to delivery of **NetSupport Manager RAT** and broader **SocGholish/FakeUpdates** activity. Trellix described a campaign in which injected JavaScript redirected visitors to counterfeit Chrome update pages, then launched a staged infection chain using JavaScript, batch files, VBScript, `curl`, and a portable **7-Zip** utility to install NetSupport while avoiding PowerShell. Mandiant documented a similar chain in which a disguised archive and scripts unpacked NetSupport from `%AppData%`, established persistence through startup shortcuts and registry artifacts, and enabled remote desktop control, file transfer, system inventory, application launch, and geolocation.
Aug 15, 2026
Attackers used compromised websites, especially **WordPress** installations, to display counterfeit browser and software update pages that tricked visitors into downloading malware. Researchers documented multiple variants of the tactic, including **FakeUpdateRU**, which replaced site files with a fake **Google Chrome** download page and distributed ZIP payloads tied to **Zgrat** and **RedLine Stealer**, and **FakeSG**, which injected JavaScript to serve browser-specific update lures that ultimately installed **NetSupport RAT**. In another related campaign, malicious code hidden in CSS through steganographic obfuscation reconstructed JavaScript that showed a fake **Flash Player** update and led victims to HTA/VBScript downloaders and PowerShell-based malware retrieval.
Aug 15, 2026
Researchers reported multiple malware delivery campaigns using **malicious email**, **fake browser updates**, and likely **content injection** on compromised websites to install infostealers and remote access trojans. One campaign abused WordPress sites to present a fake **Google Chrome** update that delivered credential-stealing malware, while another used malicious **PEC** email lures tied to crypto-wallet themes to infect targets with remote access tooling and theft-focused payloads. Separate reporting also described spam operations distributing evasive malware through email, showing continued reliance on social engineering and web-based lures to gain initial access. The activity aligns with attacker use of **MITRE ATT&CK** techniques including `T1659` for content injection and `T1555` for stealing credentials from password stores. Once installed, these malware families commonly target saved passwords and account data from browsers, email clients, FTP/SFTP tools, Wi-Fi profiles, and Windows credential stores using utilities and methods associated with tools such as **LaZagne**, **Mimikatz**, **MailPassView**, and **Network Password Recovery**. The campaigns underscore a persistent threat pattern in which adversaries combine deceptive delivery methods with credential theft to expand access, move laterally, and compromise additional systems.
Aug 11, 2026