Malicious downloads

Microsoft's Lumma Stealer analysis lists common delivery routes. They include cracked apps, search ads, and hacked sites.

Fake update pages are covered in fake browser updates.

1. An ad, search result, or email opens a download page.
2. The file poses as an invoice, resume, installer, or update.
3. A clean-looking dropper fetches the real malware after it runs.
4. Password-protected archives and signed installers slip past scanners.

A drive-by download happens during ordinary browsing. MITRE T1189 covers hacked sites and ads that deliver exploits. Some pages push a file at you. Others exploit an unpatched browser without a click.

Patching closes the known no-click routes. See exploit kits for how page-visit attacks work.

MITRE T1204.002 lists files attackers trick users into opening. They range from programs and shortcuts to disk images.

Google's Safe Browsing help describes the protection levels. Chrome's download help explains each warning.

1. Open Chrome and select More, then Settings.
2. Choose Privacy and security, then Security.
3. Under Safe Browsing, pick Enhanced protection.
4. Enhanced protection runs in-depth scans of suspicious downloads.
5. If Chrome shows Dangerous download blocked, leave it blocked.
6. For a suspicious file, choose Cancel download.

CISA lists phishing and precursor malware as ransomware entry points. A malicious download can be that precursor. Keep offline, encrypted backups and test restores. See ransomware from browser downloads.

• Signatures lag behind new payloads and packers.
• Password-protected archives hide their contents from scanners.
• New file hosts have no reputation yet.

• Block executable and script downloads from unknown sites.
• Allow exceptions through a documented request.
• Push software and updates through managed channels.
• Scan files in a sandbox before release.
• Teach staff that updates come from the app, not pop-ups.