Skip to main content
Threat playbook

Category: Malware Delivery

Ransomware from browser downloads

Ransomware can start with a malicious file from the web. The file gives attackers a first foothold.

CISA lists phishing and precursor malware as ransomware entry points. Run only software you sought out yourself. Keep offline, encrypted backups. Test that they restore.

Encryption is the final step. The first can be a single download.

Updated 2026-10-30

How does ransomware start from a browser download?

CISA's #StopRansomware guide lists six initial access routes. Phishing and precursor malware infections are two of them. A browser download can deliver that precursor malware.

  1. A link or ad leads to a fake download.
  2. You run an installer, archive, or script.
  3. It installs a loader or stealer as a foothold.
  4. Attackers spread through the network, then deploy ransomware.

What entry points does CISA list for ransomware?

CISA's ransomware entry points, mapped to the browser. Source: CISA #StopRansomware Guide.
Entry pointBrowser linkFirst defense
Internet-facing vulnerabilities and misconfigurationsNone directlyPatch exposed systems
Compromised credentialsFake login pages collect themPhishing-resistant MFA
PhishingLinks lead to downloads or sign-insVerify links before you open them
Precursor malware infectionMalicious downloads install loadersRun only software you sought out
Advanced social engineeringFake support or fake update pagesVerify requests through a second channel
Third parties and managed service providersShared portals and remote toolsLimit third-party access

CISA's ransomware entry points, mapped to the browser. Source: CISA #StopRansomware Guide.

What should you do after a suspicious download?

  1. Do not open the file. Delete it if still unopened.
  2. If you ran it, disconnect the device from the network.
  3. Tell IT or your security team right away.
  4. Change passwords from a different, clean device.
  5. Report ransomware to IC3 or a Secret Service field office.

Which backups survive ransomware?

CISA advises offline, encrypted backups of critical data. It also says to test backups regularly. A backup that stays connected can be encrypted too.

Why does detection alone fall short?

  • The user runs the file, which looks like normal activity.
  • Staged payloads and protected archives evade scanning.
  • Once encryption starts, containment becomes a race.

Which ransomware controls should teams use?

  • Block executable and script downloads from untrusted sites.
  • Keep offline, encrypted backups and test restores.
  • Enforce MFA and watch for unusual sign-ins.
  • Patch internet-facing systems quickly.
  • Drill the suspicious download scenario with your team.
  • Limit third-party remote access tools to approved vendors.

Where does browser isolation fit against ransomware?

  • Shield opens a page in an isolated browser off your device.
  • Downloads and copied data still cross that boundary.
  • Backups and patching remain the core ransomware controls.
Add to Chrome

Limits

  • Entry points follow CISA's September 2023 guide.
  • This page is not incident response advice.
  • Sources were checked on October 30, 2026.
  • Legba publishes this guide. Shield is part of Legba's Chrome extension.

FAQs.

Can ransomware really start from a link?
Yes, a link can lead to a malicious download. A fake login page works too. Either gives attackers a foothold.
Is blocking downloads enough?
No, stolen credentials and exposed systems are entry points too. Combine download rules with MFA and patching.
What if a user downloaded a suspicious file?
Disconnect the device if the file ran. Investigate the source. Rotate any exposed credentials quickly.
Do backups stop ransomware?
They limit the damage. Keep them offline and encrypted, and test restores.
Where do I report ransomware?
US victims can report to IC3 or the Secret Service. CISA also offers help.
Which file types should raise suspicion?
Programs, shortcuts, disk images, and password-protected files all deserve care. MITRE lists these among files attackers trick users into opening.
How often should we test backups?
CISA says to test backups regularly. Use a disaster recovery drill.
How does browser isolation help with ransomware?
It moves page code off your device. Files you download still need care.

References

  1. 01
    CISA: #StopRansomware GuideCISA
  2. 02
    CISA: StopRansomwareCISA
  3. 03
    MITRE ATT&CK: User Execution: Malicious File (T1204.002)MITRE
  4. 04
    Google Chrome Help: Google Chrome blocks some downloadsGoogle

Keep exploring

Try it on the next page you do not trust

Legba is a Chrome extension with two modes. Ghost gives you a private browser route. Shield opens a page in an isolated browser off your device.

Add to Chrome

Free for 30 days. No card required.

Ghost. A private route for your browser. Shield. An isolated browser, off your device. Choose the mode. Close when finished.