Fake privacy-browser geolocation lookup preceding search hijack/extension instal

Arnold Chan@slaz

•updated Sep 4, 2026•1•0•4

Detects execution patterns associated with 'NinjaMare' style malware, where a process masquerading as a browser (e.g., tenbrowser.exe, fireflybrowser.exe) performs an external IP geolocation lookup followed by suspicious registry or file modifications indicative of browser hijacking or extension installation within a five-minute window.