Tricky new malware replaces your entire browser with a dangerous Chrome lookalike

This malicious browser looks and acts just like Chrome--except for all the pop-up ads, system file hijacking, and activity monitoring.

Security researchers have discovered a fiendish form of browser malware that stands in for your copy of Google Chrome and hopes you won’t notice the difference.

As reported by PCRisk, the “eFast Browser” works by installing and running itself in place of Chrome. It’s based on Google’s Chromium open-source software, so it maintains the look and feel of Chrome at first glance, but its behavior is much worse.

First, makes itself the default and takes over several system file associations, including HTML, JPG, PDF, and GIF, according to MalwareBytes. It also hijacks URL associations such as HTTP, HTTPS, and MAILTO, and replaces any Chrome desktop website shortcuts with its own versions. Essentially, eFast Browser makes sure to open itself at any opportunity.

During use, eFast Browser constantly displays pop-up and search ads on top of the page you’re visiting. Some of these ads lead to ecommerce sites, while others redirect to potentially malicious webpages, where there’s a risk of installing more adware or malware. PCRisk also warns that the browser collects browsing information that could be personally identifiable. It’s unclear if eFast Browser adheres to any sort of privacy policy. (The company behind eFast Browser, Clara Labs, has its own privacy policy, though trying to load this page in Chrome brings up a malware warning.)

How does eFast Browser install itself in the first place? Apparently, it’s just another Potentially Unwanted Program that sneaks itself into software installers. (A program called Unchecky can help will this sort of bundleware.) In any case, the browser does clearly identify itself when visiting the About page from the Settings menu. PCRisk has detailed removal instructions.

Why this matters: As pseudonymous infosec expert SwiftOnSecurity noted, it’s a testament to Chrome’s security against in-browser malware that attackers are now trying to overwrite the program completely. With Windows looking like the weaker link, users will want to be extra careful when using software installers from untrusted sources.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Follow our new CSO Australia LinkedIn
Follow our new social and we'll keep you in the loop for exclusive events and all things security!
Have an opinion on security? Want to have your articles published on CSO? Please contact CSO Content Manager for our guidelines.

Tags malwarechrome

More about Google

Show Comments

Featured Whitepapers

Editor's Recommendations

Brand Page

Stories by Jared Newman

Latest Videos

More videos

Blog Posts