Fake browser updates spread updated WarmCookie malware

A newly observed FakeUpdate campaign targeting users in France leverages compromised websites to present fake browser and Java update prompts that install the WarmCookie Windows backdoor. Discovered by Gen Threat Labs, the campaign delivers an updated WarmCookie with capabilities for device fingerprinting, data and file theft, program enumeration, arbitrary command execution, DLL/EXE/PowerShell transfer and execution, anti-VM checks, and C2 communication; multiple deceptive domains and IoCs were reported.