In early June 2026, researchers discovered that a compromised version (1.251.91.0) of the Israel-based Hola Browser for Windows was distributing a Monero crypto miner via a supply chain attack. The malicious executable (me.exe) was bundled with the browser installation, lacked digital signatures, and was heavily obfuscated. It added itself to Microsoft Defender's exclusion list to evade detection and established persistence through a Windows background service named hola_monitor_svc. The miner operated stealthily, activating only when the computer was idle to avoid performance degradation alerts. Hola confirmed the supply chain compromise and has since enhanced security measures for its software distribution.

Affected users unknowingly had their system resources hijacked to mine Monero cryptocurrency, leading to potential performance degradation, increased electricity consumption, and reduced hardware lifespan. The attack did not involve theft of cryptocurrency or direct data compromise but resulted in unauthorized use of computing resources. The infection was limited to approximately 0.1% of Hola Browser Windows users running version 1.251.91.0.

Hola has addressed the supply chain breach by securing its update distribution pipeline to ensure only approved, digitally signed software is delivered. Users should immediately update Hola Browser to the latest version to avoid infection. Running updated antivirus solutions capable of detecting such threats is recommended. Since the vendor has confirmed remediation efforts, no additional urgent actions are required beyond updating the software.