Heimdal’s SOC flagged a surge in detections tied to a program called Shift Browser on 2 September 2026.

Our team confirmed activity on more than 50 client environments in a single day. The installers we captured trace to a malvertising lure.

Shift Browser also runs a documented paid creator and affiliate marketing operation, though we haven’t been able to draw a confirmed line between that channel and this specific wave of detections.

A familiar name in PUP and adware circles

Shift Browser markets itself as a security-focused productivity browser.

Malwarebytes has flagged the installer as PUP.Optional.ShiftBrowser since October 2024, and PCrisk and GridinSoft both track it as an unwanted application with browser-hijacking behaviour.

Shift Technologies disputes the malware label directly  Its own guidance page calls the product “designed to improve your productivity without compromising your security” and states plainly, “It is not malware.”

User reports back this up.

People describe Shift Browser auto-starting with Windows, hijacking default browser settings, and resisting standard uninstall attempts.

One Microsoft support thread walks a user through a two-step removal process. Uninstall the app, then strip its auto-start entries by hand, since the standard uninstaller leaves them behind.

How it reaches your endpoints

Distribution follows a malvertising pattern that other vendors have documented independently. Malwarebytes describes the same lure. Ads placed where people search for manuals, recipes, and document templates.

Heimdal’s SOC saw the identical pattern and blocks the downloader responsible for fetching the real installer. This lure explains the installer names our SOC captured on 2 September.

• shift – pdf_xq6n94.exe
• shift – pdf_xgeiup.exe
• shift – pdf_xtors9.exe

Each one presents itself as a PDF tool, but none are.

Shift also runs a formal creator affiliate programme, advertised to prospective creators as offering transparent rates, and at least one independent review we checked carries a tracked affiliate link back to Shift’s site.

That’s a real, separate channel for Shift generally.

We haven’t confirmed it as the delivery path for any install in this specific wave, so treat it as context, not as a second proven vector for the 2 September detections. The malvertising lure on its own is what’s producing 50-plus client environments in one day.

What the sandbox shows

Heimdal’s SOC ran the captured samples through dynamic analysis.

Our sandbox returns a Malicious verdict, with four warnings raised on a single process.

That is Heimdal’s own behavioural read of what the installer does on a machine, and it sits ahead of where most of the industry has landed.

Malwarebytes, PCrisk, and GridinSoft all classify Shift as a potentially unwanted program rather than malware outright. Our sandbox data doesn’t contradict that. It adds to it. This is what the behaviour looks like once you actually run it.

• Access to an unwanted program domain
• Executable content dropped or overwritten
• Registry queries consistent with reconnaissance behaviour
• File creation in a temporary directory

Behaviourally, the installer maps to three MITRE ATT&CK techniques.

• T1033, System Owner/User Discovery: the process reads the Windows owner and organization settings.
• T1012, Query Registry: the process reads the machine GUID, the computer name, and the list of supported languages from the registry.
• T1082, System Information Discovery: the process gathers the same class of host detail through separate system information calls.

This combination is fingerprinting. Before Shift Browser drops its payload, the installer profiles the machine it landed on.

YARA rules on the sample flag a Borland Delphi compile and confirm an InnoSetup installer wrapper.

Inside, the installer drops chrome.packed.7z, a packed Chromium build that becomes the browser engine once unpacked. That’s the pattern you’d expect from any Chromium fork.

Past the drop, the process reaches out to known malware and adware domains and writes registry changes tied to persistence and configuration.

A valid signature is not a clean bill of health

Every sample Heimdal captured carries a digital signature from Shift Technologies Inc. Treat this signature as a fact about the file, not a verdict on it.

A valid code signing certificate lowers the odds of SmartScreen or a signature-based control blocking the install. It says nothing about what the software does after that.

Adware and PUP families lean on legitimately obtained certificates for this exact reason. The signature buys trust, and trust buys reach.

Indicators of compromise

• Signing identity: Shift Technologies Inc
• chrome.packed.7z (MD5): 6f9907ea3054058adcfcb7cc23ca4287
• shift – pdf_xgeiup.exe (MD5): 491e2abd22ac4eba532144be355224e7
• shift – pdf_xtors9.exe (MD5): c6d6028596117ec564325154d3144ab4
• shift – pdf_xq6n94.exe (MD5): not confirmed at time of publish. The naming pattern and MITRE sequence below will catch this variant even without a hash match.
• Domains and IPs: not listed. Our SOC confirms this infrastructure rotates fast enough that a fixed list would be stale within hours.

What to do with this

• Block the three confirmed file hashes above across every client environment you manage. The xq6n94 variant’s hash is still outstanding, chase it before this goes live.
• Don’t wait on a static domain or IP list to act. This infrastructure rotates too fast for one to hold. The naming pattern and MITRE sequence below stay useful regardless of which domain is live today.
• Watch for the shift – pdf_* naming pattern on new installer executions, even where the hash does not match yet. The campaign rotates file names fast.
• Flag any InnoSetup installer that fires T1033, T1012, and T1082 back to back within seconds of launch. This sequence is a fingerprinting chain worth alerting on for its own sake, separate from Shift Browser specifically.
• Don’t add a binary to an allow list on signature alone. Confirm behaviour first.
• Warn your users away from ad-driven “free PDF tool” downloads, the entry point behind most of these detections.

Heimdal’s SOC keeps tracking this campaign as new samples land.

Expect the outstanding hash to land as we process the rest of the 2 September detections. Domain data will keep evolving rather than settling into a fixed list.

How Shift Browser markets itself

Shift markets through a mix of official brand accounts and a paid creator programme. The company runs verified accounts on TikTok, YouTube, and Instagram, and its Shift Creator Program page advertises transparent rates and partnerships to prospective creators.

The YouTube review we checked carries a tracked affiliate link back to Shift’s own site. That confirms the programme is active, not just advertised.

We can document that channel in general. We can’t draw a line from it to this specific campaign.

Our SOC found no correlation between any individual piece of social content and the actual installs in this wave, so treat the marketing channel as context for how Shift grows its user base, not as a confirmed delivery mechanism for the 2 September detections specifically.

If you liked this article, follow us on LinkedIn, Reddit, X, Facebook, and Youtube for more cybersecurity news and topics.