Hola Browser for Windows Compromised in Supply-Chain Attack Delivering Monero Miner
Summary
Hola confirmed a supply-chain compromise of its Windows browser that delivered an undeclared Monero miner. The company said about 0.1% of users were affected and reported rebuilding its distribution pipeline; no user-data access or theft was evidenced.
Key points
- AppEsteem certification checks uncovered an undeclared executable, me.exe, in some Hola Browser for Windows installations.
- Sophos identified the binary as a Monero miner; it added a Windows Defender exclusion, installed an auto-starting service, and ran when the computer was idle.
- Hola confirmed the supply-chain compromise; cybersecurity firm Sygnia also detected it.
- Hola said about 0.1% of users were affected and that there was no evidence of user-data access, theft, or compromise.
- Hola said it rebuilt its distribution pipeline and added code-signing verification, tighter access controls, and continuous monitoring.
- The article did not identify the perpetrators or explain how the compromise occurred.
Article Details
- Victim Organization
- Hola
- Incident Type
- Supply chain compromise of the Windows version of Hola Browser that delivered an undeclared Monero cryptocurrency miner.
- Operational Impact
- The miner was installed on some affected systems, added a Windows Defender exclusion, copied itself as HolaMonitorService.exe, created an auto-starting service named hola_monitor_svc, and ran when the computer was idle. Hola said about 0.1% of its users were affected and reported no evidence of user data access, theft, or compromise.
- Claim Status
- confirmed
MITRE ATT&CK
T1195.002 · Compromise Software Supply ChainThe Windows Hola Browser distribution pipeline was compromised to deliver an undeclared executable.T1496 · Resource HijackingThe delivered executable was identified by Sophos as a Monero cryptocurrency miner that ran when the computer was idle.T1543.003 · Windows ServiceThe miner created an auto-starting Windows service named hola_monitor_svc.T1562.001 · Disable or Modify ToolsThe miner added a Windows Defender exclusion rule.