Researchers discovered that the Windows Hola Browser was subject to a supply chain compromise, resulting in the delivery of an undeclared executable 'me.exe' containing a Monero cryptocurrency miner. This miner added persistence by creating a Windows service ('hola_monitor_svc'), copying itself as 'HolaMonitorService.exe', and adding Windows Defender exclusions. The compromise was detected during AppEsteem certification testing by Sophos and others. Hola confirmed the breach, affecting a small fraction of users, and has since rebuilt its distribution infrastructure with enhanced security measures including advanced code-signing verification and continuous monitoring.

The compromise resulted in the installation of a cryptocurrency miner on affected Windows systems, which could degrade system performance and increase power consumption. There is no evidence that user data was accessed, stolen, or otherwise compromised. The impact is limited to unauthorized resource usage on infected machines. Approximately 0.1% of Hola Browser users were affected.

Hola has completely rebuilt its distribution pipeline, implemented advanced code-signing verification, and introduced tighter access controls and continuous monitoring to ensure only certified and signed components are delivered. Users should update to the latest version of Hola Browser once available and verify their installations for unauthorized executables. Since this is a supply chain compromise, replacing the affected software with a clean, updated version from the vendor is the primary remediation step. Patch status is not explicitly confirmed; check Hola's official advisory for updates.