A new wave of malvertising campaigns is targeting Microsoft Edge and Mozilla Firefox users, primarily in North America and Southeast Asia, using fake browser update prompts delivered through compromised ad networks.Victims are lured into downloading malware like AsyncRAT and IcedID, known for remote access, data exfiltration, and initial ransomware deployment. The campaign employs JavaScript injection, sandbox evasion, and browser fingerprinting to stay under the radar.
These fake updates are visually identical to real browser prompts, adding to their success rate.
| Phase | Technique |
|---|---|
| Initial Access | Compromised Ad Network → JavaScript redirect to malicious landing page |
| Execution | Fake browser update → Downloads malware via PowerShell or HTA |
| Evasion | Sandbox detection via navigator.webdriver, userAgent, and timing checks |
| Persistence | Registry Run keys, Scheduled Tasks, or AppData payload drops |
| C2 Comms | Encrypted traffic over HTTPS or WebSockets |
Primary Target Regions:
These regions saw a spike in AsyncRAT & IcedID C2 beacons originating from browsers misled into fake update chains.
| Type | IOC |
|---|---|
| URL | update-browser-now[.]info, firefox-safe[.]com |
| SHA256 Hash | f1c9e2d019... (AsyncRAT), ab3f891a9d... (IcedID) |
| IPs | 104.243.34.199, 92.118.161.58 |
| Registry Keys | HKCU\Software\Microsoft\Windows\CurrentVersion\Run\BrowserUpdate |
X-Content-Type-Options, Content-Security-PolicyuBlock Origin with dynamic filtering enableduMatrix for granular JS/script/domain controlupdate*.exe, setup*.hta, or PowerShell scriptsyararule FakeBrowserUpdate_Payload
{
meta:
description = "Detects AsyncRAT/IcedID downloaders posing as browser updates"
strings:
$str1 = "Please update your browser"
$ps1 = "Invoke-WebRequest"
$hta = "<script language=\"VBScript\">"
condition:
any of them
}The evolution of malvertising attacks like this campaign against Edge and Firefox users reveals how attackers now weaponize trust in routine browser behavior. By mimicking legitimate update flows, these campaigns evade user suspicion and spread RATs and banking trojans silently.At CyberDudeBivash, we strongly advocate zero-trust awareness, browser isolation, and script control to counteract these social engineering-based malware delivery mechanisms.🛡️ The browser is no longer just a window to the web — it’s a frontline battleground. Harden it, monitor it, and educate users continuously.
CyberDudeBivash
Founder, Cybersecurity & AI Specialist – cyberdudebivash.com
🔗 LinkedIn | 🧠 AI-Driven Threat Research | 🛠️ Tools & Intel