This is how the fake update alerts can look. They are hard to distinguish from real goods.

![](https://steemitimages.com/DQmXgVYQApRcpPttjQWVw8EnoFmn9bKLPtpQFtkSiCP9vkr/image.png)

Malicious software is spread in many different ways, and now Malwarebytes security company reports a new outbreak of malware spread through fake browser updates.

The malware includes "banking" programs, which can be used to steal bank login information, as well as programs that can be used to transfer files or remotely control PCs.

The new malware campaign, which was first discovered in December, suggests that hackers enter code into legitimate web sites on the web. The code allows visitors to open a window with a message to update the browser when they visit the web pages, more specifically Chrome or Firefox, and in some cases Flash. These update windows should look completely authentic.

The dangerous programs are digitally signed and look legitimate. Photo: Malwarebytes
Starting with "lock file"
By clicking on the fake update window, you download a JavaScript file from another legitimate site, Dropbox shooting service. The JavaScript file is used by the hackers to look for - and avoid - virtual machines and so-called "sandbox" features. The latter is a security mechanism for isolating unknown and questionable programs.

After these checks have been completed, the "main load" is provided, which is an .exe file with the malicious program signed with an OS approved digital signature. If JavaScript programs find security mechanisms, the main program will not be delivered to the target.

According to Malwarebytes, the use of a "lock file" in the form of the JavaScript file gives the hackers great flexibility to confuse the activity and hide their "fingerprints", so it's about quite sophisticated bakers.

Websites that should have been infected with the malicious code that are behind the false update notices include, among other things, webpages published with the publishing tools WordPress, Joomla, and SquareSpace. Security companies do not know exactly how many websites are affected.