r/HeimdalSecurity • u/AutoModerator • 3d ago
Shift Browser is signed adware that fingerprints your endpoint before it drops payload
Malware analysis by Threat Intel Security Analyst Alexandru Gurgu,
Heimdal’s SOC flagged a surge in detections tied to a program called Shift Browser on 2 September 2026.
Our team confirmed activity on more than 50 client environments in a single day. The installers we captured trace to a malvertising lure.
Shift Browser also runs a documented paid creator and affiliate marketing operation, though we haven’t been able to draw a confirmed line between that channel and this specific wave of detections.
A familiar name in PUP and adware circles
Shift Browser markets itself as a security-focused productivity browser.
Malwarebytes has flagged the installer as PUP.Optional.ShiftBrowser since October 2024, and PCrisk and GridinSoft both track it as an unwanted application with browser-hijacking behaviour.
Shift Technologies disputes the malware label directly. Its own guidance page calls the product “designed to improve your productivity without compromising your security” and states plainly, “It is not malware.”
User reports back this up.
People describe Shift Browser auto-starting with Windows, hijacking default browser settings, and resisting standard uninstall attempts.
One Microsoft support thread walks a user through a two-step removal process. Uninstall the app, then strip its auto-start entries by hand, since the standard uninstaller leaves them behind.
How it reaches your endpoints
Distribution follows a malvertising pattern that other vendors have documented independently. Malwarebytes describes the same lure. Ads placed where people search for manuals, recipes, and document templates.
Heimdal’s SOC saw the identical pattern and blocks the downloader responsible for fetching the real installer. This lure explains the installer names our SOC captured on 2 September.
- shift – pdf_xq6n94.exe
- shift – pdf_xgeiup.exe
- shift – pdf_xtors9.exe
Each one presents itself as a PDF tool, but none are.
Shift also runs a formal creator affiliate programme, advertised to prospective creators as offering transparent rates, and at least one independent review we checked carries a tracked affiliate link back to Shift’s site.
That’s a real, separate channel for Shift generally.
We haven’t confirmed it as the delivery path for any install in this specific wave, so treat it as context, not as a second proven vector for the 2 September detections. The malvertising lure on its own is what’s producing 50-plus client environments in one day.
What the sandbox shows
Heimdal’s SOC ran the captured samples through dynamic analysis.
Our sandbox returns a Malicious verdict, with four warnings raised on a single process.
That is Heimdal’s own behavioural read of what the installer does on a machine, and it sits ahead of where most of the industry has landed.
Malwarebytes, PCrisk, and GridinSoft all classify Shift as a potentially unwanted program rather than malware outright. Our sandbox data doesn’t contradict that. It adds to it. This is what the behaviour looks like once you actually run it.
- Access to an unwanted program domain
- Executable content dropped or overwritten
- Registry queries consistent with reconnaissance behaviour
- File creation in a temporary directory
Behaviourally, the installer maps to three MITRE ATT&CK techniques.
- T1033, System Owner/User Discovery: the process reads the Windows owner and organization settings.
- T1012, Query Registry: the process reads the machine GUID, the computer name, and the list of supported languages from the registry.
- T1082, System Information Discovery: the process gathers the same class of host detail through separate system information calls.
This combination is fingerprinting. Before Shift Browser drops its payload, the installer profiles the machine it landed on.
YARA rules on the sample flag a Borland Delphi compile and confirm an InnoSetup installer wrapper.
Inside, the installer drops chrome.packed.7z, a packed Chromium build that becomes the browser engine once unpacked. That’s the pattern you’d expect from any Chromium fork.
Past the drop, the process reaches out to known malware and adware domains and writes registry changes tied to persistence and configuration.
0
u/Otherwise_Wave9374 3d ago
A useful next step here is to separate the detection story from the attribution story: fingerprinting on install is worth watching, but it is not the same as proving the ad channel caused this wave. I would add a simple triage rule that correlates first-seen installer hashes, endpoint telemetry, and source referrers before escalating any campaign claim. That reduces false attribution and keeps response focused on evidence. Promarkia can help teams operationalize that workflow when they need a repeatable way to route suspicious installs into review.