Researchers at eSentire’s Threat Response Unit (TRU) have reported on a malware campaign active in May 2024 which is using fake Chrome update webpages to trick users into downloading information-stealing malware. In this latest campaign, users are directed to a fake Chrome browser update page after visiting a compromised website. Users are urged to click a link to download the update, which downloads a zip file called “Update.zip”. Once opened, a malicious JavaScript file “Update.js” executes PowerShell scripts that retrieve malicious files that serve as the loaders, persistence mechanisms, and final payloads of BitRAT and LummaC2 (aka Lumma Stealer). BitRAT is categorized as a Remote Access Tool, but also includes XMR miner for cryptocurrency mining, webcam live feed, keylogger functionality, and file manager with zip compression among other capabilities. LummaC2 is a very popular infostealer which targets web browsers, crypto wallets, and other sensitive data repositories. LummaC2 has been available to threat actors as a Malware-as-a-Service since August 2022 and rose to be one of the most prevalent information stealers in 2023. While spreading malware via fake browser updates is not new, it is worth reporting to stress the importance of security awareness training for end users. eSentire notes that in April 2024 fake updates were also used to lure victims into installing FakeBat, and prior to that SocGholish was also spread using a similar technique. CTIX analysts recommend that organizations educate users on these types of malware campaigns. CTIX analysts will continue to report on new and emerging malware and associated campaigns.