Fake Browser Update

A fake browser update is a social engineering attack in which a compromised or malicious website displays a convincing overlay telling the visitor their browser is out of date and offering an "update" to download. The file is not an update at all — it is malware, most commonly an infostealer or a remote access trojan that opens the door to ransomware. The technique has run continuously for years through campaigns that security vendors track under names like SocGholish and ClearFake, and it remains effective for one simple reason: years of security training taught users that updating the browser is the responsible thing to do.

How it works

The attack starts upstream, with the mass compromise of legitimate websites — typically through vulnerable plugins or stolen admin credentials. Injected JavaScript profiles each visitor (browser, location, whether they have been shown the lure before) and renders a pixel-faithful update page matching their browser's branding. Everything about the moment feels routine: the site is one the victim trusts or found through an ordinary search, and the prompt mimics UI they have seen legitimately.

The delivered file varies — an executable posing as an installer, or a script the page instructs the user to run. Newer campaigns increasingly skip the download entirely and segue into a ClickFix-style instruction to paste a "fix" command, blending the two techniques. Either way the victim, believing they are doing security maintenance, performs the infection themselves. Because the compromised sites are legitimate and the payload rotates constantly, domain reputation filters lag behind, and attackers use SEO poisoning and malvertising to steer additional traffic toward infected pages — a pipeline we unpack in our guide to malvertising and SEO poisoning.

How to defend against it

• Teach the one golden rule. Modern browsers update themselves silently; a webpage can never update your browser. Any site that says otherwise is an attack — close the tab and report it.
• Verify in the menu. The only legitimate manual path is the browser's own menu (Help → About). Thirty seconds there resolves any doubt.
• Keep updates boring. Enterprise-managed, automatic browser patching removes the pretext: users who know updates "just happen" have no reason to believe the prompt.
• Watch the download layer. Block executable downloads from uncategorized domains and alert when a browser download spawns script interpreters.