--- title: "When PUPs Grow Fangs: Dragon Boss Solutions' $10 Supply Chain Risk" url: https://daily.dev/posts/when-pups-grow-fangs-dragon-boss-solutions-10-supply-chain-risk-yeasao162 source_url: https://www.huntress.com/blog/pups-grow-fangs type: article source: "Huntress Blog" published: 2026-05-31T07:44:04.477Z updated: 2026-05-31T08:17:00.353Z tags: ["cyber", "malware", "powershell"] reading_time: 17 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # When PUPs Grow Fangs: Dragon Boss Solutions' $10 Supply Chain Risk **[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 17 min read · 0 upvotes · 0 comments ## Summary Huntress researchers uncovered a malware operation by Dragon Boss Solutions LLC, a company distributing signed PUPs (potentially unwanted programs) that secretly deploy a sophisticated AV-killing PowerShell payload (ClockRemoval.ps1) via a legitimate software update mechanism. The payload disables and uninstalls security products like Malwarebytes, ESET, Kaspersky, and McAfee; blocks their update domains via the hosts file; establishes WMI and scheduled task persistence; and adds Windows Defender exclusions for future payload staging. Critically, the primary update domain (chromsterabrowser[.]com) was unregistered, meaning anyone spending $10 to register it could push arbitrary payloads to all infected hosts. Huntress registered the domain first, sinkholed it, and observed over 23,500 unique infected endpoints across 124 countries — including universities, government agencies, OT networks, and Fortune 500 companies — reaching out within 24 hours. Detection guidance and full IOCs are provided. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Signed software abused to deploy antivirus-killing scripts](https://daily.dev/posts/signed-software-abused-to-deploy-antivirus-killing-scripts-4yadk6l9t) · BleepingComputer · 0 upvotes · 0 comments - ['Harmless' Global Adware Transforms Into an AV Killer](https://daily.dev/posts/harmless-global-adware-transforms-into-an-av-killer-odjt9mgeg) · Dark Reading · 0 upvotes · 0 comments - [Huntress, Microsoft Detail the Continued Popularity, Evolution of ClickFix Attacks](https://daily.dev/posts/huntress-microsoft-detail-the-continued-popularity-evolution-of-clickfix-attacks-6ssrgbera) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#powershell](https://daily.dev/tags/powershell) [View this post on daily.dev](https://daily.dev/posts/when-pups-grow-fangs-dragon-boss-solutions-10-supply-chain-risk-yeasao162)