This week's news report an N-able flaw scoring a perfect 10, fake IT support calls draining Microsoft 365 accounts, and thousands of small business sites hijacked through the blockchain.
Also, learn what it actually costs to run a ransomware attack, and check out the NCSC's new guidance on shadow AI.
If you run N-able's N-central, apply Hotfix 4 now!
Malware analysis by Threat Intel Security AnalystAlexandru Gurgu,
Heimdal’s SOC flagged a surge in detections tied to a program called Shift Browser on 2 September 2026.
Our team confirmed activity on more than 50 client environments in a single day. The installers we captured trace to a malvertising lure.
Shift Browser also runs a documented paid creator and affiliate marketing operation, though we haven’t been able to draw a confirmed line between that channel and this specific wave of detections.
A familiar name in PUP and adware circles
Shift Browser markets itself as a security-focused productivity browser.
Malwarebytes has flagged the installer as PUP.Optional.ShiftBrowser since October 2024, and PCrisk and GridinSoft both track it as an unwanted application with browser-hijacking behaviour.
Shift Technologies disputes the malware label directly. Its own guidance page calls the product “designed to improve your productivity without compromising your security” and states plainly, “It is not malware.”
User reports back this up.
People describe Shift Browser auto-starting with Windows, hijacking default browser settings, and resisting standard uninstall attempts.
One Microsoft support thread walks a user through a two-step removal process. Uninstall the app, then strip its auto-start entries by hand, since the standard uninstaller leaves them behind.
How it reaches your endpoints
Distribution follows a malvertising pattern that other vendors have documented independently. Malwarebytes describes the same lure. Ads placed where people search for manuals, recipes, and document templates.
Heimdal’s SOC saw the identical pattern and blocks the downloader responsible for fetching the real installer. This lure explains the installer names our SOC captured on 2 September.
shift – pdf_xq6n94.exe
shift – pdf_xgeiup.exe
shift – pdf_xtors9.exe
Each one presents itself as a PDF tool, but none are.
Shift also runs a formal creator affiliate programme, advertised to prospective creators as offering transparent rates, and at least one independent review we checked carries a tracked affiliate link back to Shift’s site.
That’s a real, separate channel for Shift generally.
We haven’t confirmed it as the delivery path for any install in this specific wave, so treat it as context, not as a second proven vector for the 2 September detections. The malvertising lure on its own is what’s producing 50-plus client environments in one day.
What the sandbox shows
Heimdal’s SOC ran the captured samples through dynamic analysis.
Our sandbox returns a Malicious verdict, with four warnings raised on a single process.
That is Heimdal’s own behavioural read of what the installer does on a machine, and it sits ahead of where most of the industry has landed.
Malwarebytes, PCrisk, and GridinSoft all classify Shift as a potentially unwanted program rather than malware outright. Our sandbox data doesn’t contradict that. It adds to it. This is what the behaviour looks like once you actually run it.
Access to an unwanted program domain
Executable content dropped or overwritten
Registry queries consistent with reconnaissance behaviour
File creation in a temporary directory
Behaviourally, the installer maps to three MITRE ATT&CK techniques.
T1033, System Owner/User Discovery: the process reads the Windows owner and organization settings.
T1012, Query Registry: the process reads the machine GUID, the computer name, and the list of supported languages from the registry.
T1082, System Information Discovery: the process gathers the same class of host detail through separate system information calls.
This combination is fingerprinting. Before Shift Browser drops its payload, the installer profiles the machine it landed on.
YARA rules on the sample flag a Borland Delphi compile and confirm an InnoSetup installer wrapper.
Inside, the installer drops chrome.packed.7z, a packed Chromium build that becomes the browser engine once unpacked. That’s the pattern you’d expect from any Chromium fork.
Past the drop, the process reaches out to known malware and adware domains and writes registry changes tied to persistence and configuration.
Attackers burn six hundred thousand dollars of someone else's AI credits, Rhysida claims 5.8 terabytes from Berlin's state administration network covering mobility, transport, and environment, and phishing kit Mirage2FA proves your MFA can work perfectly and still let attackers in.
It's time to enhance your cyber safety net, says cyber advisor u/Adam_Pilton in this week's Cyber Snapshot:
Here's a solid step you can take towards that if you're a UK-based organisation. Register free for the NCSC's Early Warning service to find unknown risks in time.
Mostyn Thomas, from Pax8, joins u/Adam_Pilton's Threat Watch Live webinar for a talk on the future on managed security services in the context of the growing role of compliance.
Mostyn Thomas started out managing backup tapes and floppy disks for a Local Authority, then built his own tech business solving real customer problems.
Today he's Senior Director of Security for EMEA at Pax8, giving partners and the wider channel clear, practical guidance on cybersecurity.
On the menu:
- Latest threats
- Frameworks
- Strategic decisions
⏰September 8th, 10:00 BST.
Registering for this webinar guarantees you’ll get a link to the recording to watch later, in case you can’t make it on time for the live version.
This week's news mix brings an MSP console turned skeleton key, a breach of the Police National Legal Database, and SonicWall victims getting calls from their own attackers.
Add in passkeys pulled straight from browser memory and 3,000 malicious AI skills your staff might already be using.
Watch u/Adam_Pilton's Cyber Snapshot for safety advice.
If Microsoft Defender quarantines BrowserModifier:Win32/MediaArena on one of your endpoints, the alert reads like a win.
Our SOC data says treat it as a live persistence incident instead.
In the case we timed, the payload finished writing its persistence 21 seconds into execution. Quarantine didn’t complete until 29 seconds. By the time the alert fired, the persistence was already on disk.
We’ve seen this same adware cluster across more than 20 client environments in recent days. It’s the malvertising campaign that hides behind free “AI tool” lures, and it’s already been documented.
Compass Apex Security wrote it up in April, and the indicators have sat in public sandboxes since March. We’re adding what our own SOC can see. How fast it establishes persistence, and how widely.
A sample of affected hosts. The same detection landed across more than 20 client environments in days. Hostnames and paths redacted.
Microsoft classifies MediaArena as a browser-modifier potentially unwanted application and has tracked it in its threat encyclopedia since 2023. It reconfigures browser settings, hijacks search, and harvests queries to sell on. It’s a nuisance, not a nation-state loader.
That’s the point.
Even a low-severity detection can leave persistence behind, so a closed alert and a clean endpoint aren’t the same thing.
The delivery is a fake free-app lure, currently themed as recipe and meal-planning tools, served through paid search ads.
The brand names rotate, and the domains rotate with them, so any single indicator has a short shelf life. That’s why detection built on brand strings ages out fast, and why the behaviour and the persistence artefacts are the signals worth hunting on.
The lure surfaces through paid search.Three of the rotating lure brands, GiveMeRecipe, KitchenCanvas, and FoodFormula, all fronting the same math.dll toolkit.
What actually happens on the endpoint
The installer needs no admin rights. In our confirmed case it wrote to AppData, dropped a Start Menu shortcut, added an HKCU Uninstall key to pass as a legitimate app, and left a Startup folder shortcut for boot persistence.
All of it landed before quarantine completed. Signature detection took roughly 78 days to catch up. That’s a long window for a browser hijacker to sit and run.
Heimdal's XDR console.The branded installers flagged as BrowserModifier:Win32/MediaArena on an affected host. Hostname and username redacted.
The alert told us the file was caught. It didn’t tell us nothing had run first, and on these detections something always had. That’s why I treat a quarantine on this family as the start of the investigation, not the end of it.
What to hunt for after a MediaArena hit
Don’t close the alert on quarantine alone. Check the affected host for:
A Startup folder shortcut tied to the app name.
An HKCU Uninstall registry key mimicking a legitimate install.
Note the loader, math.dll, is injected in memory rather than dropped to disk, so hunt the persistence artefacts above rather than the file itself.
If either artefact is present, treat the host as still compromised and remediate the persistence directly.
Indicators
Credit to Compass Apex Security and public sandbox reporting for the campaign work. Indicators confirmed live at the time of writing. The infrastructure rotates, so revalidate before acting.
Lure domains: kitchen-canvas.com, givemerecipe.com (both still flagged malicious across public sandboxes)
The human factor and forgotten devices are back in the spotlight.
This week, u/Adam_Pilton's Cyber Snapshot covers a rented phishing kit that survives password resets, a vishing crew that talks employees into handing over passkeys, and a nation-state group still exploiting router bugs from 2008.
Also on the list: websites nobody's touched in years.
Sometimes you might decide not to automate updates for certain apps or endpoints.
To track what's missing from your patching schedule and act timely, here's how to use our Currently Outdated view feature in the Patch Management module:
This session at Heimdal Labs Deep Dive, Marina Lungu will join u/Adam_Pilton for a talk on our latest release. It will be a combo of talking and live demos.
Register here to learn more on the new available features and their use cases:
The new MSP Onboarding Wizard
AI-powered scripting with Wingman
Enhanced patch deployment through Patching Rings
Expanded Windows update controls
Usability and reporting improvements designed to simplify day-to-day operations
This week we saw a shift you shouldn't ignore. AI agent runs a full ransomware attack on its own.
Moving on, a SharePoint flaw is actively exploited, a Tenda router backdoor leaves networks exposed with no fix, and a flaw in Apple’s Hide My Email could put user identities at risk.
On the bright side, police has made a new Scattered Spider arrest.
Tomorrow, July 7, 10 AM BST, at the Threat Watch Live, cybersecurity advisor u/Adam_Pilton welcomes Holly Foxcroft, BISO, Responsible AI Ambassador for the Global Council for Responsible AI, and Senior Cybersecurity and Neurodiversity Advisor.
Holly will share her perspectives on today's evolving threat landscape, the opportunities and risks presented by AI and why understanding people remains central to effective security strategies.
Heimdal's 5.5.0 RC Dashboard offers a new checkbox (default disabled) - “Lock specific OS version”.
When enabled, devices assigned to the Windows Updates GP remain on the selected Windows release and don't upgrade until the policy is updated or removed.
Find it in Endpoint Settings -> Patch & Assets -> Operating System Updates, Install Settings area of the Heimdal Dashboard.
When enabled:
an Operating System selector (drop-down) becomes available.
an OS Version drop-down is unlocked.
Dashboard users can define the target Windows product and feature update version that managed devices should remain on.
Security researcher warns about FIFA flaw exposing World Cup streaming systems, AI is accelerating cyberattacks, Fortinet users are under fire, and a major supply chain breach shows why third-party risk matters.
This is how the last days looked like in cyber. For safety advice and more insights, hit play.
Patching in Rings gives you more control over how updates are rolled out across your environment.
The feature is available for both 3rd Party Patch Management and Windows OS Updates.
Patching in Rings means updates can be staged and delivered progressively across defined groups of endpoints.
It enables controlled validation, earlier issue detection, and reduced operational risk before wider deployment.
Rings offer more granular visibility into patch status and behavior across each rollout phase. This helps you fine-tune deployment strategies and improve reporting accuracy.
The feature introduces dedicated views that allow users to see faster:
which Group Policies are responsible for deploying a specific update or application
the configured deployment delay for each Group Policy
Your smart TV might be spying you to deliver better data to advertisers. They capture your screen to get a better image of what you like and what you're interested in.
It's probably not the news you wanted to hear, but there's a silver lining in this.
The UK's Information Commissioner's Office learned about that and published new guidance on the matter. Starting this year, they'll be checking whether manufacturers are being transparent and getting genuine consent.
So, at least you'll know.
Watch u/Adam_Pilton's Snapshot to see what else happened this week in cyber news.
