TA2727

TA2727 is a previously undocumented threat actor identified in reporting on fake browser update campaigns. It is linked to the distribution of FrigidStealer and other malware for Windows and Android, and is known for using legitimate compromised websites to present scam browser update alerts as an attack vector. Reporting states that TA2727 used these fake update lures to deploy information-stealing malware to macOS devices outside the United States in late January 2025. TA2727 has been linked to FrigidStealer activity affecting users across North America, Europe, and Asia. In the reported ecosystem, TA2726 is assessed to function as a traffic provider or traffic distribution service for TA2727, including by compromising websites and injecting Keitaro TDS links for resale. TA2727 is associated with fake update-driven malware delivery rather than exploitation of software vulnerabilities.