Hot Take Microsoft-signed “BGAUpsell.exe” pushes Bing on Windows and Chrome users


Level 4
Thread author
May 29, 2023
I thought I had malware on my main Windows 11 machine this weekend. There I was minding my own business in Chrome before tabbing back to a game and wham a pop-up appeared asking me to switch my default search engine to Microsoft Bing in Chrome. Stunningly, Microsoft now thinks it’s ok to shove a pop-up in my face above my apps and games just because I dare to use Chrome instead of Microsoft Edge.

This isn’t a normal notification, either. It didn’t appear in the notification center in Windows 11, nor is it connected to the part of Windows 11 that suggests new features to you. It’s quite literally a rogue executable file that has somehow appeared in c:\windows\temp\mubstemp and is digitally signed by Microsoft.

“We are aware of these reports and have paused this notification while we investigate and take appropriate action to address this unintended behavior,” says Caitlin Roulston, director of communications, in a statement to The Verge.

Reddit thread from 2 months ago.

VirusTotal Behavior.

File wasn't on my Windows 10 VM (yet?).

ForgottenSeer 100397

Comodo Firewall detected "BGAUpsell.exe" on my system. It has an alert setting that notifies you if any software tries to change your browser settings. I received an alert with two options: "Keep current browser settings" or "Change current browser settings".

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.