It also contained several anti-VM and anti-emulator detection capabilities to prevent researchers and security solutions from detecting its malicious capabilities. The malware's primary functionality is to steal data from browsers and crypto-wallets, Blaze said. However, besides installing a copy of the Brave browser, the ISO file also installed a version of the ArechClient (SectopRAT) malware, security researcher Bart Blaze told The Record today, after analyzing the malicious file. Users who landed on the site, which was designed to look like the legitimate Brave portal, downloaded an ISO file claiming to contain the Brave installer.

The malicious website was located at bravė.com, where Brave was spelled with a Lithuanian small caps ė (with a dot on top) instead of the normal Latin alphabet e.

Internet surfers looking to download a copy of the Brave browser were fooled this week by a cleverly disguised ad that redirected them to a malicious website where they infected their systems with malware.

Google shuts down malicious ad posing as Brave browser but delivering malware

Brave browser down