China-Linked Hackers Use Fake Chrome Certificate Warnings to Infect Victims With Sparrow Backdoor
China-linked hackers deploy SilentDelivery campaign using fake Chrome certificate warnings to deliver SquadC and
China-linked hackers are using the SilentDelivery campaign to compromise high-profile organizations in Europe and Asia by injecting malicious JavaScript into legitimate websites that displays fake Chrome SSL certificate warnings. Victims are tricked into downloading what appears to be a certificate repair utility but instead installs the SquadC backdoor or SparrowDoor variant, granting attackers remote access to Windows systems. Check Point researchers linked the campaign to CopperDragon, a possible tool supplier supporting multiple China-linked threat groups including FamousSparrow, Earth Estries, TropicTrooper, and UAT-9244.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonChina-linked threat actors injected malicious JavaScript into legitimate websites to display convincing but fake SSL certificate error pages, tricking users into downloading a trojanized 'repair utility' that installed the SparrowDoor or SquadC backdoor. The attack succeeds because users are conditioned to act on browser security warnings, making a realistic fake prompt a highly effective social engineering vector. Once installed, the backdoor grants full remote access to Windows systems, enabling espionage and lateral movement. This campaign highlights how attackers exploit user trust in browser UI conventions and legitimate-looking downloads to bypass technical defenses entirely.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — SquadC
- malware — SparrowDoor