Hola Browser Windows Delivery Pipeline Hijacked to Deploy Cryptominer

Gbhackers •Mayura Kathir • June 5, 2026

An undeclared executable bundled with Hola Browser for Windows (version 1.251.91.0) that later proved to be a crypto‑miner. The binary, written to C:\Program Files\Hola\me.exe in affected installs, was not part of the certified footprint, lacked code signing and a timestamp, contained obfuscated code and memory‑write capabilities. Analysis identified miner‑related strings, XMRig indicators, and behavior to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Hola Browser Compromised to Deliver Cryptominer via Supply Chain Attack The Hola Browser for Windows (version 1.251.91.0) was compromised in a supply chain attack, delivering an undeclared executable identified as a cryptocurrency miner. This issue was discovered during AppEsteem certification checks, which revealed the presence of the executable 'me.exe' in some installations. The binary lacked code signing, a timestamp, and contained obfuscated code, indicating malicious intent. Hola confirmed the compromise, stating that only 0.1% of users were affected and that no user data was accessed or stolen. The company has since rebuilt its distribution pipeline and implemented advanced security measures. The incident highlights significant vulnerabilities in software supply chains and the importance of rigorous application integrity checks. 6 sources 68

Extracted Entities

Hola Browser Windows Delivery Pipeline Hijacked to Deploy Cryptominer

The full story

Extracted Entities

Attack Types (2)

Malware (1)

Platforms (1)