Category: Malware Delivery

Ransomware from browser downloads in the browser

Ransomware from browser downloads happens when a user downloads and runs a malicious file delivered via a website, ad, or phishing link.

Quick answer

The browser is often the first step in ransomware chains—delivering installers, droppers, or stolen credentials that lead to broader compromise.

For drive-by content and risky downloads, isolation keeps untrusted web execution off the endpoint and makes each browsing session disposable.

When you need this

You’ve seen indicators of this threat in your environment.
Users frequently click unknown links as part of daily work.
You need a control that reduces risk without relying on perfect user judgment.

Last updated

2026-01-29

How it usually happens in the browser

A user clicks a link/ad and lands on a fake download or “update” page.
They download an installer, archive, or script that appears legitimate.
The payload drops ransomware or installs a foothold that leads to ransomware later (via lateral movement).
Attackers target finance/operations workflows where urgency drives quick clicks and downloads.

What traditional defenses miss

Many ransomware chains start with “legitimate” user actions (download + run), which is hard to prevent with detection alone.
Attackers use staged payloads, signed binaries, and password-protected archives to evade scanning.
Once execution happens, containment becomes a race against encryption and spread.

How isolation changes the game

Isolation reduces endpoint exposure by containing risky browsing and enabling strict download controls in those contexts.
If web content is executed in a disposable container and the session is deleted, the path to persistent compromise is reduced.
Policy-based isolation helps reduce the number of high-risk clicks that can deliver initial payloads.

See Legba for Chrome

Operational checklist

Block executable/script downloads from untrusted sites; use a controlled release workflow for exceptions.
Isolate unknown browsing and ad-click traffic by default.
Harden email and identity: enforce MFA and monitor suspicious logins to prevent follow-on compromise.
Ensure backups are offline/immutable and test restoration regularly.
Use incident drills for “downloaded suspicious file” and measure containment time.

FAQs

Can ransomware really start from a link?

Often it starts from a link that leads to a download or credential theft. The browser is a common entry point into the chain.

Is blocking downloads enough?

It helps a lot, but attackers can also use stolen credentials and remote access to deliver ransomware. Combine download controls with strong identity defenses.

How does isolation help with ransomware?

It reduces the chance that untrusted web content and download prompts reach endpoints, and supports policy-based controls on risky browsing paths.

What should we do if a user downloaded a suspicious file?

Isolate the endpoint, block execution if possible, investigate the source, and rotate potentially exposed credentials/tokens quickly.