Tricky malware replaces Chrome with a dangerous lookalike
Security researchers have discovered a fiendish form of browser malware that stands in for your copy of Google Chrome and hopes you won’t notice the difference.
As reported by PCRisk, the eFast Browser works by installing and running itself in place of Chrome. It’s based on Google’s Chromium open source software, so it maintains the look and feel of Chrome at first glance, but its behaviour is much worse.
First, makes itself the default and takes over several system file associations, including HTML, JPG, PDF, and GIF, according to MalwareBytes. It also hijacks URL associations such as HTTP, HTTPS, and MAILTO, and replaces any Chrome desktop website shortcuts with its own versions. Essentially, eFast Browser makes sure to open itself at any opportunity.
How does eFast Browser install itself in the first place? Apparently, it’s just another Potentially Unwanted Program that sneaks itself into software installers. (A program called Unchecky can help with this sort of bundleware.) In any case, the browser does clearly identify itself when visiting the About page from the Settings menu. PCRisk has detailed removal instructions.
As pseudonymous infosec expert SwiftOnSecurity noted, it’s a testament to Chrome’s security against in-browser malware that attackers are now trying to overwrite the program completely. With Windows looking like the weaker link, users will want to be extra careful when using software installers from untrusted sources.