Security researchers have discovered a fiendish form of browser malware that stands in for your copy of Google Chrome and hopes you won’t notice the difference.
As reported by PCRisk, the “eFast Browser” works by installing and running itself in place of Chrome. It’s based on Google’s Chromium open-source software, so it maintains the look and feel of Chrome at first glance, but its behavior is much worse.
First, makes itself the default and takes over several system file associations, including HTML, JPG, PDF, and GIF, according to MalwareBytes. It also hijacks URL associations such as HTTP, HTTPS, and MAILTO, and replaces any Chrome desktop website shortcuts with its own versions. Essentially, eFast Browser makes sure to open itself at any opportunity.
During use, eFast Browser constantly displays pop-up and search ads on top of the page you’re visiting. Some of these ads lead to ecommerce sites, while others redirect to potentially malicious webpages, where there’s a risk of installing more adware or malware. PCRisk also warns that the browser collects browsing information that could be personally identifiable. It’s unclear if eFast Browser adheres to any sort of privacy policy. (The company behind eFast Browser, Clara Labs, has its own privacy policy, though trying to load this page in Chrome brings up a malware warning.)
How does eFast Browser install itself in the first place? Apparently, it’s just another Potentially Unwanted Program that sneaks itself into software installers. (A program called Unchecky can help will this sort of bundleware.) In any case, the browser does clearly identify itself when visiting the About page from the Settings menu. PCRisk has detailed removal instructions.
Why this matters: As pseudonymous infosec expert SwiftOnSecurity noted, it’s a testament to Chrome’s security against in-browser malware that attackers are now trying to overwrite the program completely. With Windows looking like the weaker link, users will want to be extra careful when using software installers from untrusted sources.