The WarmCookie Malware Campaign: A Sneaky Threat Posed by Fake Browser Updates

The WarmCookie campaign uses compromised websites to display fake Chrome/Firefox update prompts that trick victims into installing malware which performs anti-VM checks, device fingerprinting, credential harvesting, screenshot capture, keystroke logging, command execution, and data exfiltration. Attackers deliver varied payloads—including info-stealers, remote access tools, and ransomware—targeting multiple sectors and leveraging JavaScript/HTML obfuscation and social engineering to evade traditional security tools.