Thanks twitterverse for keeping people safe 🙂- yan July 30, 2021

Since this is getting some attention today, just want to add that Namecheap promptly took down the abusive domains (for Brave, Tor, Signal, etc.) and Google blocked their ads not long after these tweets went out. Google spokespersonįurthermore, after news of the attack spread online this week, Namecheap, the domain registrar used by the attackers, took down the domain, and others from the same threat actor that impersonated the Tor and Signal websites. In this case, we immediately removed the ad and suspended the advertiser account. We have robust policies prohibiting ads that attempt to circumvent our enforcement by disguising the advertiser’s identity and impersonating other brands. Users who installed this malware are advised to reset web account passwords and transfer cryptocurrency funds to new addresses.Ĭontacted by email, Google said it has now taken down the malicious ad. It also contained several anti-VM and anti-emulator detection capabilities to prevent researchers and security solutions from detecting its malicious capabilities. The malware’s primary functionality is to steal data from browsers and crypto-wallets, Blaze said. However, besides installing a copy of the Brave browser, the ISO file also installed a version of the ArechClient (SectopRAT) malware, security researcher Bart Blaze told The Record today, after analyzing the malicious file. Image: who landed on the site, which was designed to look like the legitimate Brave portal, downloaded an ISO file claiming to contain the Brave installer.

Brave browser good for security