Loading story…
Researchers reported two active browser locker campaigns that masquerade as government and law-enforcement websites to pressure victims into paying fake fines or surrendering payment-card details. One family targeted Russian users by imitating the Russian Ministry of Internal Affairs (MVD) and demanding payments of 3,000 to 10,000 rubles, while another campaign aimed largely at users in the Middle East with counterfeit police pages that embedded payment forms to harvest card information.
The scams relied on intrusive advertising networks and browser-based tricks rather than malware that encrypts files or damages systems. The pages used full-screen mode, hidden cursors, and keyboard-handling scripts to make devices appear locked, creating urgency and fear while leaving systems technically unaffected unless victims paid or entered card data. Researchers said the fake MVD campaign affected more than 55,000 users in Q4 2020, and the Middle East-focused operation affected more than 130,000 users.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Kaspersky reported that in Q4 2020, a fake Russian MVD browser-locker family affected more than 55,000 users, while a second law-enforcement-themed family targeting the Middle East and other countries threatened more than 130,000 users. The scams used browser tricks to simulate device lockups and extort money or steal payment card data.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A cloud-hosted tech-support scam campaign used more than 250 Google Ads campaign IDs to route users through a benign-looking fake “ShopEase” storefront before presenting operating-system-specific security lockers impersonating Microsoft Defender on Windows and Apple on macOS. Between August 31 and September 14, it affected at least 619 organizations, chiefly in the United States, Japan, and Australia, with ads appearing across at least 284 legitimate publisher sites. Victims were pressured to call a fraudulent support number through full-screen browser takeovers, keyboard locking, hidden cursors, warning audio, and intentional browser-performance degradation. The campaign reflects advanced browser-based scareware techniques also documented in CypherLoc, which uses encrypted JavaScript loaders to validate, decrypt, and execute concealed payloads before replacing the initial page with a fake security warning. Such lockers evade automated inspection through interaction checks such as required mouse movement and staged AES decryption of command-and-control details and payloads, while assembling the malicious interface entirely in browser memory. They can further heighten credibility by displaying a victim’s public IP address and fake login forms, while repeatedly relocking the browser when users attempt to recover control.
Sep 28, 2026
Multiple active fraud and malware operations are abusing *trusted themes and brands* to compromise users, with a heavy emphasis on mobile-first delivery via social engineering. Zimperium reported a **targeted Android spyware** operation delivered through a fake “dating” app promoted via social media and messaging links; once installed, the app requests broad permissions (e.g., SMS, contacts, media) to enable **surveillance and data exfiltration** including messages, location, and credentials. Separately, Zimperium also described an Android campaign that **hides a RAT inside artifacts presented as legitimate AI/ML components** hosted on trusted framework infrastructure, enabling attackers to bypass basic screening and gain persistent device control (data theft, screen capture, remote command execution). In parallel, CybersecurityNews summarized two public-service impersonation campaigns tied to “traffic ticket” lures. In India, attackers are mimicking **RTO e-challan** notifications distributed via WhatsApp and other messaging platforms to push off-store Android apps that steal financial and personal data; the malware reportedly uses a **three-stage modular architecture**, dynamic remote configuration, anti-analysis, and a **custom VPN tunnel** to conceal C2 and exfiltration, while prompting victims for high-risk permissions and to disable battery optimization for persistence. In Canada, a separate operation uses **SEO poisoning** and SMS/ad lures to drive victims to **fake provincial traffic ticket payment portals** (e.g., BC, Ontario, Quebec) that harvest PII and payment card data; Unit 42 attributed the activity to a broader fraud network using a phishing kit with a “waiting room” feature and infrastructure spanning **70+ domains**, including concentration on the `45.156.87.0/24` netblock.
Jun 29, 2026
The **Razy** malware family was found compromising **Google Chrome, Mozilla Firefox, and Yandex Browser** by disabling extension integrity checks and browser auto-updates, then installing or replacing extensions with malicious versions. In Chrome-based browsers, it could infect existing extensions including the built-in **Chrome Media Router** component; in Firefox, it deployed a fake extension called **"Firefox Protection"**; and in Yandex Browser, it replaced an extension with one masquerading as **Yandex Protect**. The malware’s primary goal was **cryptocurrency theft and fraud**. It replaced wallet addresses and QR codes, altered cryptocurrency exchange pages, injected phishing and scam content, and manipulated **Google** and **Yandex** search results. Supporting scripts including `extab.js` and `bgs.js` injected remote content and sent telemetry through **Firebase**, while remotely loaded `i.js` and `main.js` handled ad injection, page modification, and wallet substitution. The campaign also used phishing domains such as `ton-ico[.]network` and `ooo-ooo[.]info`, and wallets embedded in the analyzed scripts had reportedly received about **0.14 BTC** and **25 ETH**.
Aug 14, 2026