Hot Take Malicious website escaping secure dns

[Parkinsond]

But let's be real, sometimes one can unconsciously and unintentionally fall for it.

Like when youre on your device and have not slept for three days hahahahah

I can recall, one member of MT mentioned not using AV at all.

 

[cartaphilus]

It was already dead when @harlan4096 posted the screenshot of the link lead to by the "update" button.
But I am not sure it was dead when I first posted hours before the screenshot; I did not try to click.

Damn I need to tell my wife that for the first time ever I came late.

 

[Parkinsond]

Damn I need to tell my wife that for the first time I ever I came late.

Proof of life

R

Hot Take Post in thread 'Malicious website escaping secure dns'

Dec 4, 2025

Btw clicking on Update Chrome does not do anything.

It downloads a file, Installer.59-03-4-08, or at least I could download it when I accessed the website.

• rashmi

• 
• 

Hot Take Post in thread 'Malicious website escaping secure dns'

Dec 4, 2025

The update button leads to download a malware that's based on Node.js (the most popular JavaScript runtime environment).
ESET didn't block the malware download source site like Kaspersky, but the main malicious file was detected after extraction.

VirusTotal

VirusTotal

www.virustotal.com

• SeriousHoax

• 
• 
• 

 

[stonjean633]

Damn I need to tell my wife that for the first time I ever I came late.

It's better for men to be late than women. That will equate to years of sacrifice.hehe

 

[Trident]

Just to add a bit of context, Node.JS is very popular amongst malware writers, it is the Chromium V8 minus the file system restrictions.

It is somewhat similar to WebView, however WebView2 is still sandboxed, restricted, full Chromium fork (Edge).

 

[Parkinsond]

it is the Chromium V8 minus the file system restrictions

Does disabling V8 in Chrome settings help with?

 

[Trident]

Does disabling V8 in Chrome settings help with?

Not at all, because the node.js environment is portable, it can be downloaded or shipped with the executable. In this case as the decompressed size is 24 mb it has been shipped. It is not related to or affected by Chrome in any way.

But also V8 is the Chromium engine, you can’t disable it.

 

[rashmi]

It's better for men to be late than women. That will equate to years of sacrifice.hehe

I always come when they ask me to... there's my hard life and sacrifice!

 

[cartaphilus]

I I submitted to them as well and now it's blocked,

View attachment 293469

Awesome it's a legit site they've been around before the Y2k event

 

[Brahman]

Current status at vt.

VirusTotal

VirusTotal

www.virustotal.com

 

[simmerskool]

and even later after the fact: osprey blocked it and so does Eset online checker

ESET Link Checker: Is This URL Safe?

Check any link with ESET Link Checker to see if it’s safe before you click. Protect yourself from phishing, malicious websites, and scams.

www.eset.com

 

[Parkinsond]

Not at all, because the node.js environment is portable, it can be downloaded or shipped with the executable. In this case as the decompressed size is 24 mb it has been shipped. It is not related to or affected by Chrome in any way.

But also V8 is the Chromium engine, you can’t disable it.

That what I meant

 

[Parkinsond]

Current status at vt.

VirusTotal

VirusTotal

www.virustotal.com

This list was all clean yesterday; also Norton safeweb was labeling it as safe yesterday.

 

[Parkinsond]

and even later after the fact: osprey blocked it and so does Eset online checker

ESET Link Checker: Is This URL Safe?

Check any link with ESET Link Checker to see if it’s safe before you click. Protect yourself from phishing, malicious websites, and scams.

www.eset.com

Was labeling it safe yesterday; checked it myself.

 

[SeriousHoax]

That what I meant

View attachment 293486

This could help with prevent some forms of attack/vulnerabilities. JavaScript is not a low-level language like C/C++/Rust/Zig, it's a high-level language, so speed is comparatively slower than those (still very fast). JIT (Just-in-Time Compiler) is a feature that makes JavaScript run extremely fast. Still not as fast as low-level languages but close. If you use Chrome's "Don't allow sites to use JavaScript optimizations" or enable "Enhance your security on the web" feature in Edge, it disables some JIT related features. So, security increases at the cost of performance mainly on JavaScript heavy sites. It also disables Web-Assembly but Web-Assembly is not used by most sites.
I prefer fast browsing over this added security because I myself getting affected by any such serious vulnerability is rare.

 

[Sampei.Nihira]

This could help with prevent some forms of attack/vulnerabilities. JavaScript is not a low-level language like C/C++/Rust/Zig, it's a high-level language, so speed is comparatively slower than those (still very fast). JIT (Just-in-Time Compiler) is a feature that makes JavaScript run extremely fast. Still not as fast as low-level languages but close. If you use Chrome's "Don't allow sites to use JavaScript optimizations" or enable "Enhance your security on the web" feature in Edge, it disables some JIT related features. So, security increases at the cost of performance mainly on JavaScript heavy sites. It also disables Web-Assembly but Web-Assembly is not used by most sites.
I prefer fast browsing over this added security because I myself getting affected by any such serious vulnerability is rare.

I also prefer fast browsing.
On my PC, if I disable JIT, performance is reduced by half.

In 2025, both Chrome and Firefox were affected by these vulnerabilities.
I posted it somewhere in the forum, but I can't remember where...

 

[TairikuOkami]

enable "Enhance your security on the web" feature in Edge

Yeah, the URL is blocked by GoogleSafeBrowsing, but when I enable it, it says the download is complete, but nothing actually downloads with Strict Settings.

 

[SeriousHoax]

Yeah, the URL is blocked by GoogleSafeBrowsing, but when I enable it, it says the download is complete, but nothing actually downloads with Strict Settings.

View attachment 293495 View attachment 293496

Actually, nothing downloaded even for me on default settings on my system. In the VM I had to switch to Google DNS from browser settings to make it download. DNS wasn't blocking for me at that point so I'm not sure why the download didn't trigger.
But on Edge it's nice to have a balance vs strict setting.

 

[Divine_Barakah]

Norton shows the fake Chrome updater as "Trusted" and "used by hundreds" !!!

Edit:

It seems the previous file is clean. The malicious file is the .dll file in the in app folder

 

[Divine_Barakah]

This list was all clean yesterday; also Norton safeweb was labeling it as safe yesterday.

View attachment 293488

The link is detected by Norton and its family, but the malicious fake Chrome Updater is not detected.