MalwarePublished 17 Oct 2025

Malicious Perplexity Comet Browser Download Ads Push Password Stealer Via Google Search

Source Reddit InfoSec News

Description

Malicious advertisements promoting the Perplexity Comet Browser have been observed on Google Search results, leading users to download a password-stealing malware. These ads impersonate legitimate software downloads but instead deliver a credential-stealing payload. The attack leverages search engine advertising to target users actively seeking the browser, increasing the likelihood of infection. The malware focuses on harvesting stored passwords, potentially compromising user accounts and sensitive data. There is no evidence of widespread exploitation yet, but the threat poses a medium risk due to the nature of credential theft and the attack vector. European organizations with employees or users searching for this browser are at risk, especially those with lax ad filtering or endpoint protections. Mitigation requires enhanced ad-blocking, user awareness, and endpoint detection capabilities. Countries with high internet usage and significant Google Search market share are more likely to be affected. The threat is assessed as medium severity given the impact on confidentiality, moderate ease of exploitation, and lack of authentication or user interaction beyond downloading the malware.

Impact

For European organizations, this threat could lead to significant credential theft, resulting in unauthorized access to corporate accounts, email systems, and internal resources. Compromised credentials can facilitate lateral movement, data exfiltration, and further malware deployment within networks. The use of Google Search ads as a distribution vector increases the risk of infection among employees who may be searching for legitimate software, especially in sectors with high reliance on browser-based tools. The impact on confidentiality is considerable, as stolen passwords can expose sensitive personal and corporate information. Operational disruption is possible if attackers leverage stolen credentials to disable accounts or deploy ransomware. The reputational damage from breaches caused by such malware can also be substantial. However, the current lack of known widespread exploitation limits immediate large-scale impact, though the potential for escalation remains if the campaign grows.

Defensive guidance

European organizations should implement strict web filtering and ad-blocking solutions to reduce exposure to malicious advertisements on search engines. Endpoint protection platforms should be configured to detect and block known password-stealing malware signatures and behaviors. User education campaigns must emphasize the risks of downloading software from unverified sources and encourage verification of official vendor websites. Network monitoring should be enhanced to detect unusual outbound connections indicative of credential exfiltration. Organizations should enforce multi-factor authentication (MFA) across all critical systems to mitigate the impact of stolen passwords. Regular audits of stored credentials and password hygiene practices can limit credential reuse risks. Collaboration with advertising platforms to report and remove malicious ads is also recommended. Finally, incident response plans should be updated to address credential theft scenarios and rapid containment.

Summary

This threat involves malicious advertisements appearing in Google Search results that promote the download of the Perplexity Comet Browser. Instead of delivering the legitimate browser, these ads lead users to download a password-stealing malware. The attack exploits the trust users place in search engine ads and the popularity of the browser name to trick victims into installing malicious software. Once installed, the malware focuses on harvesting stored credentials from browsers or system password stores, enabling attackers to gain unauthorized access to user accounts and potentially escalate attacks within compromised environments. The campaign was identified through Reddit InfoSec discussions and reported by hackread.com, indicating a recent emergence but with minimal current discussion or exploitation evidence. The lack of affected version details and known exploits suggests this is a newly observed threat vector rather than a vulnerability in the software itself. The malware distribution via Google Ads highlights the risk of supply chain and advertising platform abuse, emphasizing the need for vigilance in verifying download sources. The medium severity rating reflects the potential confidentiality impact of stolen credentials, the moderate complexity of the attack requiring user download action, and the absence of advanced exploitation techniques or widespread active campaigns.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 17 Oct 2025, 11:16 UTC

Technical details

References

Community reviews