Back Scworld

New browser malware uses remote commands to control Windows systems

Scworld • September 4, 2026

According to Cyber Insider, security researchers at Intezer have discovered a sophisticated browser application capable of remotely injecting keyboard and mouse commands into Windows systems, posing a significant threat to user security. This malicious operation has been active for at least 10 years.

The malware, disguised as a "privacy browser," was distributed via a deceptive result after an employee mistyped a URL. The application, built with NW.js, includes a hidden input-injection engine that allows attackers to execute commands remotely, mimicking a USB Rubber Ducky. This engine can launch applications, generate synthetic mouse and keyboard activity, modify default engines, and install browser extensions. To evade detection, the malware waits for periods of inactivity and hides browser windows during its operations.

Systems in multiple countries, including the United States, Canada, and various European nations, have been targeted with varying levels of malicious activity. The attackers utilized the MSIX installer format to appear more legitimate, leveraging Microsoft's App Installer. However, inadvertently captured registry data exposed developer artifacts, linking this campaign to NW.js-based attacks dating back to 2016.

Source: Cyber Insider

SC Staff September 3, 2026

SC Staff September 2, 2026

Get daily

You can skip this ad in 5 seconds

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Malware Hijacks Windows with Remote Commands via Deceptive Browser App Security researchers at Intezer have identified a malicious browser application that can remotely inject keyboard and mouse commands into Windows systems. This malware, disguised as a 'privacy browser,' was distributed after an employee mistyped a URL, leading to an MSIX installer that evaded antivirus detection. The application, built with NW.js, features a hidden input-injection engine that allows attackers to execute commands remotely, similar to a USB Rubber Ducky. The malware waits for user inactivity and hides browser windows to avoid detection. Systems in the US, Canada, and several European countries are affected, with the operation dating back at least ten years. Registry data inadvertently captured during the MSIX package creation exposed developer artifacts, linking this campaign to earlier NW.js-based attacks. The malware's use of the MSIX format helps it appear legitimate, leveraging Microsoft's App Installer for distribution. 1 sources 64

Extracted Entities

New browser malware uses remote commands to control Windows systems

The full story

Extracted Entities

Attack Types (1)

Countries (2)

CWE Weaknesses (1)

MITRE ATT&CK (2)

Platforms (4)