Loading story…
Compromised websites were used to display a fake warning claiming the site’s security certificate had expired, prompting visitors to install a malicious update. Attackers injected HTML and JavaScript that loaded an iframe from ldfidfa[.]pw, placing a fraudulent overlay on top of the legitimate page while keeping the real site URL visible in the browser bar. Users who clicked the prompt downloaded Certificate_Update_v02.2020.exe, a file detected as Exploit.Win32.ShellCode.gen and analyzed as the Trojan-Downloader.Win32.Buerak malware packaged with Nullsoft Scriptable Install System (NSIS).
The activity was observed across multiple hacked websites covering different themes, indicating a broad web-based malware distribution campaign rather than a single-site compromise. Researchers linked the same infrastructure or operation to earlier distribution of Backdoor.Win32.Mokes, with the earliest identified infections in this wave dating to January 16, 2020, showing that the fake certificate lure was used to deliver both downloader and backdoor malware families.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
The earliest infections identified in the campaign dated to January 16, 2020. Victims visiting compromised sites were shown a fake expired-certificate warning that pushed a malicious update.
Earlier in January 2020, the same fake certificate-update campaign was used to distribute Backdoor.Win32.Mokes through compromised websites.
In the campaign, injected HTML and JavaScript loaded an iframe from ldfidfa[.]pw over legitimate websites and prompted users to install Certificate_Update_v02.2020.exe. Analysis identified the downloaded file as Trojan-Downloader.Win32.Buerak.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used compromised websites, especially **WordPress** installations, to display counterfeit browser and software update pages that tricked visitors into downloading malware. Researchers documented multiple variants of the tactic, including **FakeUpdateRU**, which replaced site files with a fake **Google Chrome** download page and distributed ZIP payloads tied to **Zgrat** and **RedLine Stealer**, and **FakeSG**, which injected JavaScript to serve browser-specific update lures that ultimately installed **NetSupport RAT**. In another related campaign, malicious code hidden in CSS through steganographic obfuscation reconstructed JavaScript that showed a fake **Flash Player** update and led victims to HTA/VBScript downloaders and PowerShell-based malware retrieval.
Aug 15, 2026
Security researchers reported that **ClickFix** has expanded into an industrialized malware-delivery ecosystem that relies on social engineering rather than software exploits. Attackers use fake CAPTCHA checks, browser updates, meeting errors, and verification prompts to trick users into manually running attacker-supplied commands through trusted tools such as PowerShell, `mshta`, `curl`, Windows Run, or macOS Terminal. ReversingLabs said the ecosystem now supports a wide range of payloads, including **Lumma Stealer**, **DarkGate**, **XWorm**, **AsyncRAT**, **NetSupport**, and **SectopRAT**, while related variants such as **CrashFix**, **FileFix**, **PromptFix**, and **ConsentFix** continue to emerge. The activity is being amplified through large-scale web compromise campaigns. Reports linked the **DriveSurge** actor to active **ClickFix** and **FakeUpdates** operations abusing thousands of compromised websites to distribute malware, while a separate SlowMist investigation documented a Google Sites-hosted phishing campaign targeting Web3 users on macOS with a fake community application flow that pushed victims to download a `.scpt` file or run a Base64-encoded Terminal command. That infection chain delivered a Mach-O stealer resembling **AMOS (Atomic macOS Stealer)**, which harvested browser credentials, cookies, Keychain data, Apple Notes, Telegram Desktop data, and cryptocurrency wallet files before archiving data to `/tmp/lksopo.zip` and exfiltrating it to `86.54.25.213`. Researchers said structural **YARA** detection of lure pages is currently one of the most effective ways to identify these campaigns, which often evade traditional AV and EDR controls because they depend on legitimate tools and user-approved execution.
Jul 18, 2026
Researchers reported continued abuse of **fake browser and software update pages** on compromised websites to trick Windows users into installing malware, with multiple investigations tying the lure to delivery of **NetSupport Manager RAT** and broader **SocGholish/FakeUpdates** activity. Trellix described a campaign in which injected JavaScript redirected visitors to counterfeit Chrome update pages, then launched a staged infection chain using JavaScript, batch files, VBScript, `curl`, and a portable **7-Zip** utility to install NetSupport while avoiding PowerShell. Mandiant documented a similar chain in which a disguised archive and scripts unpacked NetSupport from `%AppData%`, established persistence through startup shortcuts and registry artifacts, and enabled remote desktop control, file transfer, system inventory, application launch, and geolocation.
Aug 15, 2026