Heimdal reports a real-world surge of detections where users were lured by malvertising into downloading executables that pretended to be PDF tools, but installed “Shift Browser” instead. The installer fingerprints the computer (reads system/registry details) before unpacking a Chromium-based payload and making changes associated with persistence and adware behavior. All captured samples were digitally signed by “Shift Technologies Inc,” which helped them appear more trustworthy.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You Google a free PDF tool, click the top ad, and download a file called “shift – pdf_xgeiup.exe.” You think it’s a PDF helper, but it silently fingerprints your PC, unpacks a Chromium-based Shift Browser, and sets itself up to flood you with ads. Here’s the trap: the installer is digitally signed by “Shift Technologies Inc,” so it looks legit, and the ad comes from wherever you search for manuals, recipes, or document templates. If you ever see a “shift – pdf_*.exe” from a search ad, stop and report it to IT, then only install PDF tools from our approved software portal.
Researchers say the Iran-linked group Nimbus Manticore posed as recruiters on LinkedIn and job platforms to send developers “technical challenge” ZIP files that secretly installed cross-platform remote access trojans. The lures used urgency (short test windows) and realistic developer workflows…
Attackers are exploiting GTA 6 hype by creating convincing fake Rockstar-branded “demo” websites that appear in Google search results. The sites use “Play Now”/“Official Download” lures to trick people into downloading a small Windows executable that installs Vidar infostealer and steals saved…
Microsoft says a Russian-linked group is abusing hotel and conference Wi‑Fi “captive portals” to trick travelers into entering corporate credentials or installing malware. Victims see what looks like a normal Wi‑Fi login flow, but attackers manipulate DNS/website traffic to redirect them to fake…
Researchers reported a real malware campaign where attackers trick people searching for Flash Player into installing a fake “Flash” installer that delivers the AtlasRAT remote-access trojan. Once installed, AtlasRAT gives the attacker long-term remote control, including credential theft and data…
This roundup describes multiple real-world campaigns where attackers trick people into installing malicious software that looks legitimate (a fake Claude desktop app, a fake emergency alert app, and banking-malware phishing). The common pattern is “looks normal, feels urgent,” leading users to…
Researchers reported that scammers set up cloned piracy sites within hours of Christopher Nolan’s The Odyssey release to trick people looking for pirated copies. The scams used a fake “Browser Issue Detected” pop-up to push users into malicious ad redirects and a Windows .exe file disguised as a…
