Researchers warn this ‘privacy browser’ behaves like malware

A web browser claiming to keep your data safe may be doing exactly the opposite. According to a new investigation, an app called Universe Browser, which has reportedly been downloaded millions of times, surreptitiously installs dangerous software and routes your internet traffic through servers in China.

The findings were reported by Wired, which reviewed a study shared with it by cybersecurity firm Infoblox and the United Nations Office on Drugs and Crime (UNODC). The researchers say the ‘privacy browser’ behaves a lot like malware, with features that resemble keylogging, secret connections to external servers, and background activity that alters device settings. It even blocks features like right-click menus and developer tools, and disables key browser security protections.

Infoblox says the app appears to be linked to a network of illegal gambling sites and cybercrime groups operating in Southeast Asia. While Universe Browser’s ads pitch it as a “fast” and “privacy-focused” option that “keeps you away from danger,” researchers say it seems to do the reverse.

The browser can be downloaded directly from casino websites and is available for Windows and iOS, though it isn’t listed on the Google Play Store. On Android, you can only sideload the APK file, which is hosted on gambling-related pages and promoted to players as a way to circumvent local restrictions.

Infoblox says it hasn’t confirmed whether the browser’s creators intended to use it maliciously, but its setup could make it easy to monitor or steal information from users. The report said, “In the hands of a malicious actor… this browser would serve as the perfect tool to identify wealthy players and obtain access to their machine.”

Infoblox says the case shows how cybercriminal groups in the region are getting more sophisticated, using apps that look legitimate on the surface to conceal their true intentions.