SecurityNov 4, 2026, 4:49 AM UTC·2 min read

Fake Samsung Browser Update on Hacked Sites Spreads Android Malware

Security firm Everspin found legitimate company websites injected with scripts that push a fake Samsung browser plugin and trick Android users into installing malware.

Smartphone showing a fake Samsung browser plugin update prompt on a legitimate website, with a warning icon. — Image: 미래를 보는 창 - 전자신문

SUMO

Dialo

ediviewer

Security firm Everspin said on Wednesday it has identified attacks in which legitimate websites display a fake browser update notice to push visitors into installing a malicious Android app. The company found externally hosted scripts injected into sites across several sectors, including fishing, audio equipment and hospitals.

How the attack works

Visitors to a compromised site see a pop-up claiming a Samsung browser plugin must be installed. Tapping the install button downloads an app file. Running it triggers a second prompt saying a further update is needed, which leads to a second app installation.

Android requires explicit user consent to install apps from outside the official app store. According to Everspin, the attack steers users into granting the "install unknown apps" permission. The final malicious app does not appear in the normal app list. It shows up in device settings under the name "Samsung".

Active only at certain hours

Everspin also saw signs that the attackers switched the distribution path on only at certain times. The install prompt and download function worked from roughly 7 to 8 a.m. until around noon, while other hours produced errors. Because the behavior changes with the time of day, a security check may miss the malicious activity depending on when it runs.

Why it matters

Everspin argues the case exposes the limits of handling web hacking and mobile phishing as separate problems. When a company's website becomes a delivery channel for malicious apps, its visitors become targets as well. The firm pointed to its web security product Eversafe Web and its malicious app detection tool FakeFinder as part of an integrated approach covering both web services and mobile devices.

Everspin CEO Ha Young-bin said hacking and phishing are linked in this chain: a site is breached to create a distribution channel, then users are deceived into installing the app. He added that in an environment where AI helps attackers analyze, build and modify attacks, securing only the web or only mobile cannot cover the whole attack path.