Fake Browser Updates Lead to BOINC Volunteer Computing Software | Huntress

Huntress documents a July 2024 campaign where compromised websites deliver Fake Browser Update (update.js) payloads that install fileless AsyncRAT via obfuscated PowerShell and a maliciously-configured BOINC client used as a C2 mechanism; the report includes IOCs (domains, IPs, file hashes), persistence artifacts (scheduled tasks, registry), detection opportunities, MITRE ATT&CK mappings, and evidence of thousands of clients connecting to malicious BOINC servers.