Fake browser update malware

What the message looks like

How this scam works

These fake updates and fake CAPTCHA pages often appear on hacked legitimate websites. The download is malware that steals passwords, cookies and crypto wallets, or lets scammers control your computer.

The 'paste this command' trick copies a malicious command to your clipboard and asks you to press Windows+R, paste and Enter. It looks like a technical step, but it's running malware.

Browsers like Chrome and Edge update themselves. You never need to download an update from a website.

Password-stealing malware is quiet. You may not notice anything until accounts are taken over days later. That's why, if you ran a fake update or command, it's important to act even if everything seems fine.

Fake update pages often appear after a redirect, so you may not even notice you've left the site you meant to visit. Some target only certain visitors, which makes them hard for site owners to spot. If a familiar site suddenly demands an update, it's likely been compromised, and it's worth telling the owner.

On a work computer, tell your IT team right away. Stolen session cookies can let attackers into company systems without needing a password.

Red flags

• Websites telling you to update your browser.
• Downloads named like browser updates.
• 'Verify you're human' steps asking you to paste a command.
• Instructions to press Windows+R or open a terminal.
• Pages that block content until you act.

How to tell it’s fake

1. Check for updates in the browser's own settings menu.
2. Never run commands a website gives you.
3. Close the tab if a page insists on downloads.
4. Keep your computer's security software on.
5. Look at the file name and type. A real browser never arrives as a .zip, .js or .exe from a random page.

What to do if you clicked, paid or shared info

Don’t panic, and don’t blame yourself. These scams are built by professionals. Act quickly, one step at a time.

If you clicked a link or called back

• Close the page. Don't download or paste anything.

If you paid

• If you paid anyone, contact your card issuer.

If you shared personal info, a password or a code

• If you ran a file or command, disconnect from the internet, run a full security scan, and change important passwords from a different device. Sign out of all sessions.

Questions people ask

Does Chrome ever ask me to download updates from websites?

No. Chrome updates itself.

What's the fake CAPTCHA scam?

A fake human check that asks you to paste and run a malicious command.

I ran the command. What now?

Disconnect, scan your computer and change passwords from another device.

Can legitimate sites show fake updates?

Yes, if they've been hacked.

Sources

• FTC: How to spot, avoid, and report tech support scams
• Microsoft: Protect yourself from tech support scams