{
  "family": "google",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "Adware/PUP:Win32/Google (Fake Updates) refers to malware or highly aggressive Potentially Unwanted Programs (PUPs) that deliberately abuse the 'Google' brand name, logos, or update mechanisms to deceive users into installing them. While Google Chrome and Google Updater are legitimate services, attackers frequently create malicious binaries named `chrome_update.exe` or `google_installer.exe` to bypass user suspicion and deploy adware, browser hijackers, or info-stealers (`T1036.005`).<br><br><b>Understanding 'Fake Google' Malware (Masquerading)</b><br>To an end-user, a pop-up stating 'Your Google Chrome is out of date' seems legitimate and urgent. They click the link, download the file, and assume they are securing their browser. For a security team, this is a classic Social Engineering attack leveraging brand trust. The resulting infection is rarely a highly sophisticated APT, but rather noisy adware that degrades system performance and monetizes user data.<br><br><b>Execution and Masquerading Mechanics</b><br>This malware is usually delivered via malvertising (malicious ads on legitimate sites) or compromised WordPress blogs redirecting users to fake 'Chrome Update' landing pages (`T1189`). Upon execution, the malware relies entirely on masquerading (`T1036.005`)—hiding its true nature by adopting the name, icon, and sometimes even a stolen/invalid digital signature resembling Google Inc. It often establishes persistence by creating Scheduled Tasks named 'GoogleUpdateTaskMachineUA' (mimicking the real Chrome updater) (`T1053.005`), but pointing to the malicious payload in `%AppData%` instead of `%ProgramFiles%`.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from severe browser hijacking (adware) to credential theft, depending on the payload. Host-based IoCs are centered on identifying the masquerade: EDR alerts for executables named `chrome.exe` running from incorrect directories (e.g., `%Temp%` or user profiles instead of `Program Files`), unsigned or improperly signed binaries claiming to be from Google, and anomalous Scheduled Tasks. Network IoCs include the 'updater' communicating with unknown, non-Google domains.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1036.005",
    "T1053.005",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1036.005",
      "name": "Masquerading: Match Legitimate Name or Location (Abusing the Google brand to bypass user suspicion)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Distribution via fake update pop-ups on compromised sites)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task (Mimicking legitimate Google Update tasks for persistence)",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Use EDR or an anti-malware tool to locate the fraudulent executables; pay close attention to the file path (e.g., executing from `%AppData%`).",
    "Review and delete any Scheduled Tasks masquerading as Google Updaters that point to unrecognized binaries.",
    "Reset all web browsers to default settings, as these fake updates frequently install malicious extensions and hijack search settings.",
    "Educate users that legitimate browser updates occur automatically in the background, and they should never download an 'update' executable from a pop-up."
  ],
  "what_to_avoid": [
    "Do not trust a file simply because it is named `chrome.exe` or has a Google icon; always verify the file path and digital signature.",
    "Avoid blindly whitelisting all processes with 'Google' in the name in your EDR/AV policies."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}