[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftaBG3qHotRW8RpHSBOPHCaTJfLWwygOE0WkoPkePc34":3},{"article":4,"iocs":52,"watch_terms":59,"solutions":60,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"47ed4231-5e99-4668-86fc-083c11e09932","China-Linked Hackers Use Fake Chrome Certificate Warnings to Infect Victims With Sparrow Backdoor","china-linked-hackers-use-fake-chrome-certificate-warnings-to-infect-victims-with-c5c479","China-linked hackers are turning trusted websites into malware delivery points by displaying fake Google Chrome certificate warnings. The pages urge selected visitors to install a certificate repair utility, but the download instead installs a backdoor that gives attackers remote access to Windows computers. The campaign, tracked as SilentDelivery, targets high-profile organizations mainly across Europe and […] The post China-Linked Hackers Use Fake Chrome Certificate Warnings to Infect Victims With Sparrow Backdoor appeared first on Cyber Security News.","China-linked hackers are using the SilentDelivery campaign to compromise high-profile organizations in Europe and Asia by injecting malicious JavaScript into legitimate websites that displays fake Chrome SSL certificate warnings. Victims are tricked into downloading what appears to be a certificate repair utility but instead installs the SquadC backdoor or SparrowDoor variant, granting attackers remote access to Windows systems. Check Point researchers linked the campaign to CopperDragon, a possible tool supplier supporting multiple China-linked threat groups including FamousSparrow, Earth Estries, TropicTrooper, and UAT-9244.","China-linked hackers deploy SilentDelivery campaign using fake Chrome certificate warnings to deliver SquadC and","https:\u002F\u002Fcybersecuritynews.com\u002Ffake-chrome-certificate\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FChina-Linked-Hackers-Use-Fake-Chrome-Certificate-Warnings-to-Infect-Victims-With-Sparrow-Backdoor.webp","2026-11-11T09:24:07+00:00","2026-11-11T10:00:33.803385+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"CopperDragon","threat_actor",{"name":21,"type":19},"FamousSparrow",{"name":23,"type":19},"Earth Estries",{"name":25,"type":19},"TropicTrooper",{"name":27,"type":19},"UAT-9244",{"name":29,"type":30},"Sparrow framework","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53,56],{"type":35,"value":54,"context":55},"SquadC","Previously undocumented C\u002FC++ backdoor identified by Check Point, supports command execution, file operations, and screenshots",{"type":35,"value":57,"context":58},"SparrowDoor","Backdoor variant delivered via SilentDelivery campaign, part of Sparrow framework ecosystem",[],{"controls":61,"vendors":147},[62,91,118],{"slug":63,"name":64,"problem":65,"products":66},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":92,"name":93,"problem":94,"products":95},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":113,"product_name":114,"url":116,"description":117},"dnsfilter","DNSFilter","\u002Fvendor-logos\u002Fdnsfilter.png","https:\u002F\u002Fwww.dnsfilter.com\u002F","DNS filtering for offices and roaming devices.",{"slug":119,"name":120,"problem":121,"products":122},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",[148],{"slug":149,"name":150,"logo_path":151,"roles":152},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png",[153],"reported_by",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":164},"fake-chrome-certificate-warnings-trick-users-into-installing-sparrow-backdoor","Fake Chrome Certificate Warnings Trick Users Into Installing Sparrow Backdoor","China-linked threat actors injected malicious JavaScript into legitimate websites to display convincing but fake SSL certificate error pages, tricking users into downloading a trojanized 'repair utility' that installed the SparrowDoor or SquadC backdoor. The attack succeeds because users are conditioned to act on browser security warnings, making a realistic fake prompt a highly effective social engineering vector. Once installed, the backdoor grants full remote access to Windows systems, enabling espionage and lateral movement. This campaign highlights how attackers exploit user trust in browser UI conventions and legitimate-looking downloads to bypass technical defenses entirely.",[159,160,161,162,163],"MITRE ATT&CK T1189: Drive-by Compromise","MITRE ATT&CK T1204.002: User Execution: Malicious File","NIS2 Article 21(2)(g)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SI-3: Malicious Code Protection",{"NIS2 Article 21(2)(g)":165,"MITRE ATT&CK T1189: Drive-by Compromise":166,"NIST SP 800-53 SI-3: Malicious Code Protection":167,"MITRE ATT&CK T1204.002: User Execution: Malicious File":168,"CIS Control 2: Inventory and Control of Software Assets (v8)":169},"This point requires organizations to maintain basic cyber hygiene and training programs, which would directly address the user susceptibility to fake browser certificate warnings exploited in this campaign.","Attackers injected malicious JavaScript into legitimate websites to deliver the backdoor installer when victims visited those sites, which is precisely the technique this ATT&CK entry describes.","This control requires deploying and configuring malicious code protection mechanisms at endpoints and network boundaries, which would detect or block the trojanized utility before it could install the backdoor.","The campaign relies on victims actively clicking and running the fake certificate repair utility, making user execution of a malicious file the critical step enabling the compromise.","Enforcing software allowlisting under this control would have prevented the unauthorized backdoor installer from executing on victim endpoints."]