Case file · anonymized · PUP · malvertising · consumer

Eleven Wave Browser installs. Two years. One family member.

The fake antivirus popup people call about is only the visible failure. The invisible failure is the slow drip that took a working laptop and turned it into forty-seven potentially-unwanted programs installed from paid ad clicks over two years. Bing sold the majority of the traffic. Google Display sold most of the PUP-installer flow. Meta sold the discovery. Every ad was paid; every install had a receipt.

July 16, 2026 · 9 min read · worked by the principal

A second family member called this week with the "the computer is doing something weird" call. Not the tech-support-scam popup that another family member had called about a few days earlier — a different shape of problem. Browsers had been getting slower and slower for months. New Chrome installations weren’t sticking. Toolbars that shouldn’t be there kept coming back. Ads showing up in places that shouldn’t have ads.

We pulled ninety days of browser history off the machine and ran the same analyzer we’d used on the earlier incident. But then we also pulled the full downloads log from Chrome and Edge, which reaches back further than the URL history does. That’s where the story was.

What the browser history shows (recent surface)

The paid-ad mix on this machine is completely different from what we saw on the earlier fake-AV incident. That one was Meta-dominated at two-thirds of ad exposure. This one is Bing-dominated at almost a third of it — and Bing paid ads are the primary vehicle by which PUP-installer download pages find people. The person on this laptop is a heavy user of the default Windows search bar, which routes queries through Bing. Every time the browser broke, they searched Bing for “download Chrome” and clicked the paid ad at the top of the results. In the last forty-eight hours alone they clicked four Bing ads that led to the real Chrome download page and installed ChromeSetup.exe four separate times, because each time the previous install was already broken by the last PUP they’d accepted.

What the downloads log shows (two-year cumulative)

The downloads log is the most damning artifact on this system. Chrome and Edge together record every file the user downloaded, when, and what page referred them. Here is the inventory of potentially-unwanted programs, browser hijackers, and adware installers this one person clicked and accepted over roughly two years:

Not one of those is malware in the traditional signature-detection sense. Every one of them is legitimate in the "the vendor is a registered corporation and their installer is signed" sense. Every one of them was served as a paid ad through a platform — Bing, Google Display, Meta — that took money to place it in front of this person. And the aggregate effect of accepting eleven Wave Browser installs, six Shift-as-fake-PDF installs, five TotalAV installs, and a dozen other PUP-installers over two years is exactly the "browser is broken again" state that triggered this call.

The desktop shortcut trick

The most instructive artifact in the whole download log is this one line, from July 2nd of this year:

2026-07-02 23:17:03   shift.exe   from: file:///C:/Users/Home/OneDrive/Desktop/PDF.lnk

Every time this person double-clicked the shortcut labelled “PDF” on their desktop — the one that they thought was a PDF viewer or a specific document — they were launching the Shift email-and-calendar-overlay installer. The .lnk filename is PDF. The target is shift.exe. Someone (or a previous PUP install) placed that shortcut on the desktop with a name designed to fool someone into launching it repeatedly. That is why Shift got installed six times — not because the user was making the same mistake six times, but because the desktop was set up to reinstall Shift every time they opened what they thought was a document.

The recent 48-hour spiral

Reading the last two days of download log tells the story:

• Chrome extension or PUP breaks Chrome for the user.
• User opens Edge (which is why we have Edge history at all — a normal person doesn’t use two browsers).
• User Bings "download chrome" from the Edge address bar.
• Top result is a paid Bing ad. User clicks. Downloads ChromeSetup.exe. Runs it. Chrome is still broken because the underlying PUP is still installed.
• User tries again. Downloads ChromeSetup.exe a second time. Still broken.
• User Bings "browser fix." Top result is a paid ad for Ace Browser AI. User clicks, downloads, installs. Now Ace Browser is also installed, competing with Chrome and Edge for the default-browser slot.
• Chrome still broken. User downloads it a third and fourth time.

Every one of those events made the machine worse. Every one of them started with a paid ad Bing was paid to serve.

The money math

Using published industry averages, over the ninety-day window covered by the browser history the platforms collected approximately:

That is roughly twice what the platforms collected on the fake-AV incident earlier this week from a different family member. This person — who is not particularly online, who does not shop obsessively, who uses their computer mainly for email and photo sharing — was targeted by more than four paid ads per day on average, of which a nontrivial fraction led to installer download pages that resulted in permanent-until-manually-removed software being placed on their machine.

Why the platforms tolerate this

Every product on that PUP inventory table above is technically legitimate. Wave Browser, Shift, OneLaunch, OneStart, TotalAV — all real corporations, all with terms of service, all with signed installers. Bing’s ad-safety filters, Google’s ad-safety filters, and Meta’s ad-safety filters are not designed to reject "the product this ad promotes is technically legitimate but functionally an adware creep vector when installed by an elderly user who thinks they’re getting a free PDF viewer." The category doesn’t exist in their moderation taxonomy.

Every install in the table above was legitimate as far as the ad platforms are concerned. The eleven Wave Browser installs, taken individually, are eleven perfectly compliant transactions. Taken as a two-year pattern targeting the same person, they are a slow-motion functional attack that no automated safety layer will ever catch, because there is no attack — there is only revenue.

What actually fixes this

The remediation for this shape of case is not the fake-AV cleanup playbook — there is no browser locker to close, no ScreenConnect to remove, no domain to sinkhole. The fix is a full uninstall pass of everything on the PUP inventory, followed by a browser reset of every installed browser, followed by a specific hunt on the desktop for shortcuts whose displayed name doesn’t match their target executable. In this case, one line of PowerShell would have prevented the six Shift installs over the last six months:

Get-ChildItem $env:USERPROFILE\Desktop, "$env:OneDrive\Desktop" -Filter *.lnk |
  ForEach-Object {
    $sh = New-Object -ComObject WScript.Shell
    $target = $sh.CreateShortcut($_.FullName).TargetPath
    $displayed = $_.BaseName
    if ($target -and (Split-Path -Leaf $target) -notlike "*$displayed*") {
        Write-Host "MISMATCH: '$displayed' -> $target"
    }
  }

Anywhere that reports MISMATCH is a shortcut that lies about what it launches. Those are the ones to delete first.

The pattern the platforms will not name

This is the second family-member incident this week we have gone deep on. In one case, Meta was paid to deliver an ad that ended in a fake antivirus browser locker and a scam phone call. In the other case, Bing and Google Display were paid over two years to deliver forty-seven paid ads that ended in forty-seven potentially-unwanted programs installed on the same laptop. Different endpoints, same shape:

• Paid ads to elderly-adjacent audiences.
• Landing pages whose primary purpose is not the ad’s stated product but the installer/redirect/subscription/support-scam that follows.
• Every step technically compliant. Every step revenue-positive for the platform. Every step degrading the target machine and the target person’s trust in their own computer.

The fake antivirus browser locker is what makes the news. The slow drip of paid ads to paid PUP installers to paid subscription traps is what actually breaks the world for people we love.

This case has been anonymized per our marketing policy. The 402 clicks, 123 Bing hits, 110 Meta hits, 63 Google hits, the eleven Wave Browser installs, the six Shift installs, the four ChromeSetup reinstalls in a day, and the desktop-shortcut trick are all exact numbers from one family member’s browser history and download log. The exact vendor names above are unaltered because they are commercial products with public advertising presence, not private information. Personally identifying details have been generalized.

Seeing this pattern in your tenant? The person who worked this case answers the email. Originally published on the Envyously blog.