Fake browser updates are an easy way to trick unsuspecting users into downloading and installing malware which is why hackers keep using them in their attacks.

Threat actors are seen distributing the new macOS stealer in a web inject campaign, along with stealers for other operating systems.

Researchers warn of rising macOS-targeted attacks as hackers exploit fake updates to bypass security. FrigidStealer malware highlights growing enterprise risks.

TA2726, per the enterprise security firm, acts as a TDS for TA2727 and another threat actor called TA569, which is responsible for the distribution of a JavaScript-based loader malware referred to as SocGholish (aka FakeUpdates) that often masquerades as a browser update on legitimate-but-compromised sites.