Microsoft Windows Warning—Do Not Install This Critical Update

New attack warning for Windows users NurPhoto via Getty Images A critical new warning this week, as a dangerous new browser update attacks Microsoft Windows…

NurPhoto via Getty Images

A critical new warning this week, as a dangerous new browser update attacks Microsoft Windows users in the wild. As ever, this attack deploys social engineering to lure users into the simple click they’ll quickly regret. Here’s what to look for.

ForbesFBI’s New iPhone, Android Warning—Is Your Data At Risk?By Zak Doffman

The warning comes by way of Palo Alto Networks’ Unit 42, per Cyber Security News which picked up on the research. The attackers have injected “malicious JavaScript” into legitimate websites that will warn users they have an outdated browser module in Chrome, Edge or Firefox and need to update.

“These lures,” Cyber Security News says, “leverage realistic branding and urgency warnings, such as ‘Critical Security Update Required’.” By downloading and running the script, the malware will fetch the NetSupport RAT code it needs to attack your PC, including an executable that enables remote device control, a library enabling data exfiltration and also Windows “Registry modification scripts for persistence,” making it hard to kill the process when it’s up and running on your machine.

The researchers also warn that “in recent campaigns observed on February 18, 2025, NetSupport RAT delivered a secondary payload: StealC, a credential-stealing malware.” That does exactly what is says on the tin, and hunts for key login data and bypasses.

The researchers warn “the SmartApeSG campaign underscores the persistent threat of social engineering coupled with fileless attack techniques. By exploiting trusted software update mechanisms and Windows internals, threat actors achieve prolonged network access while evading conventional defenses.”