Attackers are utilizing hacked web sites that promote fake browser updates to infect targets with banking trojans. In some cases, post exploitation toolkits are later executed to encrypt the compromised network with ransomware.

Between May and September 2019, FireEye has conducted multiple incident response cases where enterprise customers were infected with malware through fake browser updates.

Hacked sites would display these “fakeupdates” through JavaScript alerts that state the user is using an old version of a web browser and that they should download an offered “update” to keep the browser running “smoothly and securely”.