Delivery technique · MITRE ATT&CK T1189, T1204.002

Fake browser updates

Compromised websites that show a fake 'update your browser' prompt which downloads malware.

How it works

1. A legitimate site is compromised with injected script.
2. Visitors see an urgent update banner.
3. The download is malware, often a loader for ransomware.

Defenses

• Browsers update themselves; never download updates from a web page.
• Block script and executable downloads from untrusted sites.
• Keep endpoint protection that flags loader families.

Reference: MITRE ATT&CK T1189 Drive-by Compromise