Heimdal’s MXDR team flagged a surge in detections tied to a program called Shift Browser on 2 September 2026. Our team confirmed activity on more than 50 client environments in a single day. The installers we captured trace to a malvertising lure. Shift Browser also runs a documented paid creator and affiliate marketing operation, though […]

The post Shift Browser is signed adware that fingerprints your endpoint before it drops payload appeared first on Heimdal Security Blog.

If Microsoft Defender quarantines BrowserModifier:Win32/MediaArena on one of your endpoints, the alert reads like a win. Our SOC data says treat it as a live persistence incident instead. In the case we timed, the payload finished writing its persistence 21 seconds into execution. Quarantine didn’t complete until 29 seconds. By the time the alert fired, […]

The post MediaArena malvertising: why a quarantine isn’t the end of the incident appeared first on Heimdal Security Blog.