ClearFake Explained: The Fake Browser Update Trick Infecting UK Devices

🦠 What Is ClearFake?

If you've been following YourScam's scam feed, you'll have noticed one tag appearing again and again: ClearFake. It's one of the most active malware distribution campaigns we track, and it's responsible for a significant chunk of the 444 critical-severity reports in our database.

ClearFake works by injecting fake browser update prompts into compromised websites. When you visit an affected page, you see what looks like a legitimate Chrome, Firefox, or Edge update notification. Click "Update" and you've just installed malware.

📊 ClearFake in Our Data

Across YourScam's 1,637 reports, the malware landscape breaks down like this:

ClearFake specifically targets everyday users — people browsing the web on desktop computers. Mozi and Mirai, by contrast, target internet-connected devices like routers and security cameras.

🔬 How a ClearFake Attack Works

1. Compromise — Attackers inject malicious JavaScript into a legitimate website (often through vulnerable WordPress plugins or stolen FTP credentials).
2. Detection — When you visit the page, the script checks your browser type and operating system.
3. Overlay — A full-screen overlay appears showing a fake browser update prompt that matches your actual browser.
4. Download — Clicking "Update" downloads a .exe or .dmg file containing an info-stealer (commonly Lumma, Raccoon, or RedLine).
5. Infection — The malware harvests saved passwords, browser cookies, crypto wallets, and banking credentials.

🎯 Why It's Effective

• Browser update prompts are something people expect to see — we've been trained to click "Update" when prompted.
• The overlays are pixel-perfect replicas of real browser update screens.
• The compromised website itself may be completely legitimate — a local business, a blog, a news site.
• Anti-virus may not catch it immediately because the download URL changes frequently.

🛡️ How to Protect Yourself

1. Real browser updates never come from websites — Chrome updates through Settings → About Google Chrome. Firefox through Settings → General → Firefox Updates. Edge through Settings → About Microsoft Edge.
2. If you see an update prompt on a webpage, close the tab — Don't click anything on the overlay. Just close it.
3. Keep your browser set to auto-update — This way you know it's always current without needing to click anything.
4. Use an ad blocker — Many ad blockers also block malicious script injection, adding a layer of protection.
5. Run a scan if concerned — If you think you may have clicked a fake update, run a full scan with Malwarebytes (free) or Windows Defender immediately.

Already clicked a fake update? Disconnect from the internet, run a full malware scan, change all passwords from a different device, and monitor your bank accounts closely for the next 30 days.

Data sourced from YourScam.org's live intelligence pipeline, powered by URLhaus/abuse.ch threat feeds.