China-Linked Hackers Use Fake Chrome Certificate Warnings to Infect Victims With Sparrow Backdoor

China-linked hackers are turning trusted websites into malware delivery points by displaying fake Google Chrome certificate warnings.

The pages urge selected visitors to install a certificate repair utility, but the download instead installs a backdoor that gives attackers remote access to Windows computers.

The campaign, tracked as SilentDelivery, targets high-profile organizations mainly across Europe and Asia. Attackers compromised websites connected to government, shipping, IT, and research sectors, using familiar browser error messages to persuade visitors that installing software was necessary to regain access.

Check Point researchers identified the previously undocumented SquadC backdoor during their investigation, alongside cases delivering a SparrowDoor variant.

Their November 10 research report connects SilentDelivery to a wider malware ecosystem associated with CopperDragon, a possible developer and supplier supporting several China-linked threat groups.

China-Linked Hackers Use Fake Chrome Certificate Warnings

The infection begins when a victim opens a compromised website. Injected JavaScript replaces the page with a counterfeit Chrome SSL certificate warning, written in the website’s language.

An added “Install certificate” button offers a supposed fix that downloads a malicious Windows Installer package. This approach resembles earlier fake Chrome update campaigns that used compromised websites to push malware, but SilentDelivery presents the download as certificate repair rather than a browser update.

Check Point found three S3 buckets it believed were compromised and used to host next-stage payloads. The JavaScript uses the publicly available jsjiami obfuscation service to hide its purpose.

Before displaying the warning, it checks whether the visitor uses Windows and, in some versions, whether the current website matches the intended domain. These checks help restrict delivery to suitable targets.

Repeated requests to attacker infrastructure support checks based on IP address and location. The operators can decide whether to leave the genuine page visible or replace it with the warning.

Clicking the installation button reports the interaction, while execution of the backdoor separately registers a successful compromise.

After infection, the fake warning disappears on later visits. That detail matters: restoring normal access makes the repair appear successful and may discourage the victim from reporting what happened.

The campaign therefore combines selective targeting with feedback that helps operators manage each stage of delivery.

SquadC, written in C/C++, loads into memory through a separate, three-stage loader. It supports command execution, file creation and deletion, directory listings, system information collection, and screenshots.

Configurable checks look for virtual-machine artifacts and other signs of automated analysis; another option requires a browser to remain running.

Sparrow Framework Links Reveal a Wider Espionage Ecosystem

SilentDelivery is one of three clusters Check Point connected to the Sparrow framework. Earlier reporting on new SparrowDoor backdoor variants documented the malware’s continuing development, but the latest findings caution against treating every intrusion involving related tools as the work of one group.

CopperDragon may act as a digital quartermaster, supplying tools to operators including FamousSparrow, Earth Estries, TropicTrooper, and UAT-9244.

The researchers based their connections on malware similarities and infrastructure features, including reused certificates. They explicitly warned that shared backdoors or servers do not establish a single operator.

The OceanGate cluster initially compromised internet-facing Linux systems before moving into Windows environments.

Its tools included SparrowShell, a Linux backdoor sharing code and design features with SparrowDoor, alongside modified SSH components that captured credentials during administrative activity. The attackers also deployed tools for reconnaissance and credential theft.

DarkWire focused on telecommunications providers and government organizations in Latin America, deploying CopperDoor and CopperDNS.

Related coverage of FamousSparrow Exchange server intrusions describes SparroWocky, the name ESET uses for CopperDoor. CopperDNS instead carries command traffic through DNS MX queries, giving operators another communication channel.

For defenders, the immediate lesson is to investigate unexpected certificate-repair downloads rather than accept their browser branding. SilentDelivery relies on users executing the installer; the reported chain does not demonstrate a Chrome vulnerability.

Investigations should also consider related phishing delivery, which Check Point observed distributing SquadC through a malicious shortcut inside an archive.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post China-Linked Hackers Use Fake Chrome Certificate Warnings to Infect Victims With Sparrow Backdoor appeared first on Cyber Security News.