Loading story…
Heimdal detected a surge of Shift Browser infections affecting more than 50 client environments in a single day. The campaign uses malvertising for purported PDF tools to distribute signed installers, including files named shift – pdf_xgeiup.exe; the installers fingerprint the endpoint before deploying a packed Chromium-based browser payload. Although some vendors categorize Shift Browser as a potentially unwanted application, Heimdal’s dynamic analysis classified the observed samples as malicious and linked them to browser-hijacking behavior.
The pre-payload reconnaissance includes endpoint and user-context discovery consistent with MITRE ATT&CK T1033 (System Owner/User Discovery), a technique attackers use to collect logged-on-user and privilege information for victim profiling and follow-on tasking. Defenders should not treat the Shift Technologies code signature as trustworthy, and should block known hashes, monitor for the distinctive filename pattern and discovery-to-browser-install sequence, and account for rapidly rotating campaign infrastructure.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Dynamic and YARA analysis of captured installers found that they queried user, registry, and system information, then dropped a packed Chromium browser archive and made persistence-related registry changes. Heimdal assigned the samples a malicious verdict despite their Shift Technologies code signatures.
Heimdal's SOC detected a surge of Shift Browser activity across more than 50 client environments in one day. The campaign used malicious advertisements posing as PDF tools to deliver digitally signed installers using filenames such as "shift – pdf_xgeiup.exe."
Malwarebytes detected the Shift Browser installer as PUP.Optional.ShiftBrowser beginning in October 2024.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked multiple fake PDF and document-converter utilities to a broader malware delivery ecosystem that abuses trusted software components, valid code-signing certificates, and Electron or Nativefier-based installers to evade detection. Analyses of **TamperedChef**, **Aura Document Studio**, **Omni Transform**, **Doc Convert Wizard**, **OpenMyManual**, and **ManualReaderPro** describe staged installation chains in which browser-downloaded executables launch temporary installers, deploy rebranded applications, and contact shared infrastructure including `softwareinstallercdn[.]com`, `tool[.]securedocumentinstaller[.]com`, and `docu-flex[.]com`. Several samples reused identical payloads across different publisher names, while others were signed with valid EV certificates, reinforcing the appearance of legitimacy. The reported payloads include clipboard hijacking, host fingerprinting, persistence, and a JavaScript backdoor embedded in `helper.js` that retrieves the Windows `MachineGuid`, communicates over encrypted HTTPS with hardcoded command-and-control domains, and executes server-supplied code via `eval()`. The installers also showed signs of stealth and anti-analysis, including long dormancy periods, WebView2Loader abuse, Chromium-style child processes, plausible DLL names used as camouflage, and suspected DLL sideloading involving files such as `libEGL.dat` and `d3dcompiler_47.dll`. The campaign echoes older trust-based intrusion techniques documented in malware that hid behind signed Avast and Oracle executables through DLL search-order hijacking, underscoring how attackers continue to weaponize legitimate binaries and software trust to deliver credential theft and follow-on malware.
Jun 29, 2026
Threat actors are compromising legitimate websites and injecting fake browser-update prompts that redirect visitors through traffic-filtering infrastructure to malware downloads. The campaigns, including SocGholish, ClearFake, RogueRaticate/FakeSG and others, tailor lures to victims’ browsers and commonly deliver remote-access tools, loaders, and credential stealers such as NetSupport RAT, Lumma, StealC, Redline, Raccoon v2, and SectopRAT. Users may reach affected sites through routine browsing, search results, social-media links, or previously legitimate links in email and newsletters. ClearFake activity has used the IDAT loader—also tracked as **GHOSTPULSE**, **HIJACKLOADER**, or **IDATLOADER**—to stage payloads through fake Chrome updates, MSI installers, DLL side-loading, process injection, Process Doppelgänging, and evasion of user-mode security hooks. GHOSTPULSE initially concealed encrypted payloads in PNG `IDAT` chunks and later shifted to embedding data in PNG pixel values; recent delivery also includes fake CAPTCHA pages that trick users into running clipboard-injected PowerShell commands. Organizations should block or restrict unapproved browser and application installers, monitor PowerShell, DLL side-loading, suspicious MSIX installs, and browser-initiated downloads, and train users to reject update or CAPTCHA prompts presented by websites.
Sep 11, 2026
Microsoft reported that a macOS-focused **ClickFix** campaign evolved from openly serving fake download pages to using server-side browser fingerprinting that shows the malicious lure mainly to likely macOS victims. The operation used more than **250 look-alike domains**, often following dictionary-style naming patterns that included the token `file`, and presented spoofed **GitHub-themed** pages with a fake **Download for macOS** prompt. Victims were tricked into pasting a Terminal command that fetched remote scripts and installed infostealers including **Atomic Stealer (AMOS)** and **MacSync**. The gating logic collected browser, hardware, and anti-analysis signals before deciding whether to deliver the lure, including `navigator` data, WebGL GPU details, timezone, iframe status, touch support, console serialization behavior, and prototype-tamper checks; non-qualifying visitors were sent blank or benign decoy pages. Separate IOC material tied the same broader activity to additional macOS infostealer infrastructure, including **SHub Stealer**, suspected delivery and command-and-control domains, a SHA-256 sample hash, and capabilities such as screenshot capture, file download, command execution, and self-deletion, reinforcing that the campaign relied on rotating lure domains and stealthy staging to target macOS users.
Aug 27, 2026