Proofpoint said: "The fake browser update lures are effective because threat actors are using an end-user's security training against them.... To an end user, it still appears to be the same website they were intending to visit and is now asking them to update their browser." READ MORE British Gas in hot water over bill change and customers say 'it's unfair' Proofpoint added: "Each of these methods reaches out to a stage 2 domain which does additional filtering and will deliver the fake browser update lure and payload to traffic that passes the filtering. The payload can be either a plain JavaScript (.js) file, usually named "Update.js", or a zipped JavaScript file." "The activity detailed in this report can be hard for security teams to detect and prevent and may present difficulties with communicating the threat to end users due to the social engineering techniques and website compromises used by the threat actor. The best mitigation is defense in depth," it went on.