Loading story…
ChromeLoader malware spread through malvertising tied to torrents and cracked software, using ISO files on Windows and DMG files on macOS to lure users into installing multi-stage droppers. Rather than deploying a conventional payload, the campaign installed malicious browser extensions that hijacked search activity, opened advertisements, and exfiltrated queries from search engines including Google, Yahoo, and Bing to attacker-controlled infrastructure.
Researchers linked the activity to a rapidly evolving malware family also tracked as Choziosi Loader and ChromeBack, with variants observed across Windows and macOS. The malware used scheduled tasks, registry Run keys, PowerShell, batch files, bash scripts, and heavily obfuscated JavaScript to establish persistence and complicate analysis, showing a cross-platform adware and infostealer operation designed to resist removal and maintain long-term browser access.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Variant 2 emerged in March 2022 and used ISO images with hidden files and LNK shortcuts, then batch scripts and PowerShell to establish persistence and install extension version 6.0.
A macOS ChromeLoader variant emerged in March 2022, using DMG files and bash scripts to install malicious extensions targeting Google Chrome and Safari.
ChromeLoader Variant 1 was first seen in January 2022, using a .NET dropper, malicious ISO images, scheduled-task persistence, and extension versions 2.0 through 4.4.
ChromeLoader, also known as Choziosi Loader and ChromeBack, was discovered in January 2022 as a browser hijacker and adware campaign spread through malicious browser extensions.
An earlier ChromeLoader Windows variant, identified as Variant 0, was active in December 2021 and used AutoHotKey-compiled executables with malicious browser extension version 1.0.
A newer in-the-wild ChromeLoader version was analyzed using heavily obfuscated PowerShell to fetch and execute a C# stager that installed a malicious browser extension from AppData. The variant targeted Chromium-based browsers, included nonfunctional Firefox code paths, redirected Google searches through attacker-controlled infrastructure to Bing, and used encrypted QUIC communications plus new indicators such as Withyourrety[.]xyz.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 314 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
cybergeeks.tech
Open sourceunit42.paloaltonetworks.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 identified **CL-CRI-1171**, a long-running pay-per-install operation that uses its custom **OfferLoader** malware to distribute payloads for separate criminal operators. The group lures victims through SEO-poisoned fake software-download sites and at least 11 gaming-focused YouTube channels offering trojanized installers. The search-result campaign has affected corporate, government, and critical-infrastructure endpoints, demonstrating that commodity download lures can lead to enterprise compromise. OfferLoader fingerprints victims and gates payload delivery to limit scanner visibility; researchers found more than 10,000 distinct loader samples and over 200 rotating domains. Payloads observed in 2026 included **Insomnia RAT**, **ARKTunnel**, and **Docro Hijacker**, followed by **GCleaner** and **Socks5Systemz**, enabling remote access, network tunneling, proxy services, and Chrome search and advertising hijacking. The operation illustrates the use of ATT&CK `T1608.006` SEO poisoning, in which attackers manipulate search rankings and may use cloaking or redirects to steer targets to malicious infrastructure while evading inspection.
Sep 14, 2026
Threat researchers reported separate malware campaigns that used fake or pirated software distribution channels to infect Windows users with credential theft and traffic-interception malware. In one campaign, attackers seeded cracked software sites with a trojanized `WinX_DVD_Copy_Pro.exe` that launched an obfuscated HTA through `MSHTA`, deployed an upgraded **CountLoader v3.2**, and ultimately delivered **ACR Stealer** entirely in memory. The loader established persistence with scheduled tasks, profiled infected hosts, authenticated to command-and-control with a JWT token, and supported additional payload delivery through ZIP, DLL, MSI, PowerShell, and removable-media propagation tasks. A second campaign abused interest in **DeepSeek-R1** by promoting a fake DeepSeek site through Google Ads and delivering a malicious installer, `AI_Launcher_1.21.exe`, backed by fake CAPTCHA pages, PowerShell, AES-decrypted payloads, and a domain-generation routine. The final malware, **BrowserVenom**, installed a rogue root certificate and reconfigured browsers to send traffic through the attacker-controlled proxy `141.105.130[.]106:37121`, allowing interception and collection of user web activity. Researchers said the operations relied on impersonation-themed infrastructure and low-detection payloads to evade defenses, with BrowserVenom infections observed in Brazil, Cuba, Mexico, India, Nepal, South Africa, and Egypt.
Aug 14, 2026
Researchers linked **PrivateLoader** to a long-running pay-per-install malware ecosystem that used SEO-poisoned sites and cracked-software lures to infect Windows users with password-protected ZIP archives and NSIS installers. The loader was repeatedly observed delivering a wide range of payloads, including **RedLine**, **Vidar**, **SmokeLoader**, **RisePro**, **Qbot**, **Dridex**, **DanaBot**, **TrickBot**, **Kronos**, **LockBit**, **STOP Djvu**, and **Conti**, while related tooling such as **Discoloader** and the Go-based **Anubis Loader** expanded the same distribution chain. Investigations described administration panels used to manage payload links, browser extensions, bot installs, and operator activity, with one panel reportedly overseeing about **20,000 bots** and collecting more than **11 GB** of stealer logs in less than two weeks. Separate reporting showed PrivateLoader also acting as an access broker for other criminal and state-linked operations. Analysts observed it distributing **ColibriLoader** in a campaign tied to **UAC-0113**, a group CERT-UA has associated with **Sandworm**, and later delivering **Socks5Systemz**, a proxy botnet that converted infected Windows hosts into rentable proxies. Bitsight estimated Socks5Systemz had about **10,000 infected systems** and at least **53 servers** supporting command-and-control, telemetry, DNS, and backconnect functions, with customers buying proxy access through a Telegram-linked service for cryptocurrency. Across the reporting, PrivateLoader emerged as a versatile initial-access platform connecting commodity stealers, banking trojans, ransomware, proxy monetization, and higher-end intrusion activity.
Aug 15, 2026