Malicious “privacy browser” hijacks PCs with mouse and keyboard injection

Security researchers at Intezer have uncovered a deceptive browser application that can remotely inject keyboard and mouse commands into Windows systems.

The campaign was discovered after an employee mistyped a single character while following setup instructions for a newly purchased mouse. Intezer researchers found that the resulting infection was part of an operation with infrastructure and techniques dating back at least ten years.

Instead of entering the legitimate setup address, the employee typed “.con” rather than “.com”, prompting Google to perform a search. A sponsored result led through an advertising traffic broker to a page promoting a supposed “privacy browser.” After completing a CAPTCHA, the victim received an MSIX installer.

Intezer says neither the installer nor the installed application attracted meaningful antivirus attention. The MSIX package typically receives between zero and two detections on VirusTotal, while the malicious component remained undetected when the report was published.

The installed application is a functional browser built with NW.js, a framework that combines web technologies with native application capabilities. Researchers found no meaningful privacy-enhancing features.

More concerning is a hidden input-injection engine added to NW.js, which can launch applications and generate synthetic mouse and keyboard activity, effectively giving the operator remote control comparable to a USB Rubber Ducky, but delivered over the internet.

Commands come from the browser's remotely hosted interface rather than files stored locally, allowing operators to change their instructions without updating the installed application. Intezer observed the mechanism modifying default search engines and installing browser extensions, but said it is generic enough to control other applications, including launching PowerShell and entering commands.

To avoid attracting attention, the software waits until a computer has been idle for at least seven minutes and moves browser windows off-screen while performing injected actions.

Systems in the United States, Canada, the UK, Germany, France, Italy, Spain, Sweden, the Netherlands, and Australia receive both search-engine changes and browser extensions. Some countries are blocked entirely, while users elsewhere receive only the extension.

The malware's use of MSIX also helps it appear trustworthy. Microsoft's App Installer presents packages using a polished Windows interface, and software distributed through the Microsoft Store can inherit Microsoft's signing chain.

However, the attackers made an operational mistake. Registry data accidentally captured while building the MSIX packages exposed details of the developer's everyday computer, including VS Code, Telegram, AdsPower, GeoVPN, WhatsApp, iCloud, and Spotify.

Those artifacts led Intezer to earlier NW.js-based campaigns distributing fake applications associated with WhatsApp, Instagram, Messenger, Tinder, and other services. VirusTotal network records from January 2016 indicate the activity has been running for at least a decade.

Users should avoid relying on search advertisements for software downloads. Applications should instead be obtained directly from verified vendor websites or trusted stores, while ad-blockers can help hide promoted results entirely.