A fake Chrome certificate warning on hacked sites installed spying tools, Check Point says

Check Point Research has published a year-long investigation into three espionage campaigns against telecoms, governments, militaries, research institutions and critical infrastructure in Latin America, Asia and Europe. They looked separate at first, with different tools and methods. Check Point says they share infrastructure and code from one family of malware, Sparrow, and it tracks the entity behind that toolkit as CopperDragon.

These are targeted spying operations, not attacks on home users. One technique is worth knowing about anyway, because it works on anyone who visits the wrong website at the wrong time: a fake browser warning that tells you to install a “fix”.

The fake certificate warning

In a campaign Check Point calls SilentDelivery, active since early 2026, the attackers first broke into legitimate websites that their targets were likely to visit. Check Point says the confirmed sites were linked to government, shipping, and IT and research organizations, and that the campaign mainly targeted organizations in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia.

Hidden code on those sites checked each visitor. If the visitor was on Windows and looked like a target, the page was replaced by what looked like a Google Chrome certificate error, translated into the site’s language, with an “Install certificate” button for a “Certificate Fix” utility. Clicking it downloaded an installer that set up a backdoor, either a previously unknown one Check Point calls SquadC or a version of SparrowDoor. Once the victim ran it, the fake warning stopped appearing, so the site looked normal again on the next visit.

Check Point also found SquadC sent by phishing email to organizations in Indonesia, hidden in an archive with a shortcut file disguised as a PDF.

The other two campaigns

• OceanGate (2025 to 2026) mainly hit organizations in Asia. The attackers got in through internet-facing Linux servers, harvested passwords, then moved into Windows networks by guessing administrator passwords over remote desktop. Check Point found new tools for keylogging, clipboard monitoring and stealing Windows login secrets, and says some Sparrow backdoors now include kernel-level rootkit features to hide.
• DarkWire (since mid-2025) targets telecommunications providers and government organizations in Latin America with backdoors Check Point calls CopperDoor and CopperDNS.

Who is behind it

Check Point describes CopperDragon as a possible “digital quartermaster”: a developer and supplier of tools used by several China-nexus groups, including FamousSparrow, Earth Estries, Tropic Trooper and UAT-9244. It notes that FamousSparrow has previously been linked to Salt Typhoon, but says the exact relationship remains unclear. This is an assessment based on shared tools and infrastructure, not a confirmed identity.

What you can do

1. A real certificate error never asks you to install anything. Chrome, Edge, Firefox and Safari show certificate warnings with a way back, not a download. If a page tells you to install a “certificate fix”, close the tab.
2. Don’t run installers that a website pushes on you, even on a site you trust. Get software from the vendor’s own site or your organization’s IT team.
3. Be wary of shortcut files disguised as documents. A “PDF” that ends in .lnk, or opens a command window, isn’t a PDF.
4. If you run a website, keep its software and plugins up to date. Check Point says one site was compromised through a cross-site scripting flaw in a form field.
5. If you clicked “Install certificate” on a page like this, disconnect the computer and contact your IT or security team. Change important passwords from a different, clean device.

How Frame helps

This campaign plants spying tools on computers at organizations. It doesn’t leak personal details from a company’s database, so there isn’t a breach to add. Frame can look up your verified emails in Have I Been Pwned’s breach database for other breaches. Frame doesn’t scan devices for malware.

Related coverage

• Poisoned websites delivered data-stealing exploits to outdated iPhones and Android phones: another watering-hole campaign, where hacked websites were used to reach chosen visitors.
• Turla’s new Cereal malware quietly copied government email from inside Exchange servers: another state-linked spying toolkit documented this week.

Sources

• Check Point Research, Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe, November 10, 2026
• The Hacker News, Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem, November 10, 2026