A supply chain compromise affecting the Hola Browser installation pipeline. During a routine AppEsteem Windows Certified Application test, analysts identified an unexpected cryptomining executable bundled alongside Hola Browser version 1.251.91.0.
This incident highlights the ongoing threat of hijacking distribution pipelines to deliver malicious payloads to unsuspecting users.
AppEsteem, an AMTSO-certified organization, regularly validates software to ensure shipped binaries match their declared, certified footprints.
When testing the Hola Browser installer against multiple independent security products, Sophos detected an undeclared component flagged as a Potentially Unwanted Application (PUA).
This rogue file, named me.exe, was written to the C:\Program Files\Hola\ directory during installation.
Hola Installer Delivers Cryptominer
The presence of the undeclared binary indicated a variance in the software delivery path rather than a static payload issue.
Because the malicious file did not appear in every third-party test run, researchers deduced that the injection depended on specific build channels, Content Delivery Network (CDN) behaviors, or release pipeline configurations.
Following responsible disclosure by Sophos and AppEsteem, Hola initiated an immediate incident response.
Hola, CEO Avi Raz Cohen confirmed that internal monitoring had also detected anomalous activity within their update distribution pipeline.
The company halted the affected pipeline, removed the unwanted software from its infrastructure, and engaged independent cybersecurity firm Sygnia for a forensic investigation.
According to Hola, the supply chain compromise affected approximately 0.1% of their user base, and forensic findings confirmed that no user data was accessed or exfiltrated. To prevent future incidents, Hola has entirely rebuilt its distribution pipeline.
The company implemented advanced code-signing verification and introduced continuous infrastructure monitoring, along with stricter access controls, to ensure only certified components reach end users.
Initial analysis of the dropped me.exe binary revealed several red flags typical of evasive malware.
The file lacked a digital signature and timestamp, contained obfuscated code, and possessed memory-write capabilities. Sophos officially tracks the malicious payload as Troj/GoMiner-B.
Telemetry data confirmed the binary functions as a stealthy cryptominer designed to exploit host resources. The malware exhibits the following operational characteristics.
Leverages a Go module path (m/cmd/xmrig-idle), indicating it is based on the XMRig mining software. Executes a Windows Defender exclusion command to evade local antivirus detection.
Monitors system states to halt operations when a user is active, ensuring the mining process remains stealthy. Copies itself to C:\Program Files\Hola\HolaMonitorService.exe when executed with administrative privileges.
Establishes persistence via a new service named hola_monitor_svc, configured to autostart during system idle times.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
