Threat actors are using a toolkit called Domen to trick visitors into visiting compromised websites and installing malware under the guise of a browser update or missing font. The client-side JavaScript responsible for the fake updates is one of the most thorough and professional coding jobs we had ever seen. Domen is a well-made toolkit that has been used to distribute a variety of payloads by using tried and tested social engineering tricks. Malwarebytes for Windows Premium users are already protected against this distribution campaign and its accompanying payloads.”]