[DramaKing]

Yes because that's not the message it says. It blocks the file and says it's malicious.

Yes, that's the point. You could download some previously unseen and unsigned program, and Chrome wouldn't give a peep. That's AMSI/AV. Defender results are not 100% consistent. You're probably just unlucky based on your region. Below is an example of Safe Browsing.

[loadman]

also before u look for ways to bypass chrome download detection,understand it how it works:


> > step 1 → Chrome Safe Browsing checks URL + file hash + reputation

> > step 2 → file gets saved with Zone.Identifier (MotW, ZoneId=3 = internet)

> > step 3 → MotW flags it as “from internet” to Windows/apps (not detection)

> > step 4 → when you run it, SmartScreen does reputation check

> > step 5 → Defender/AV may scan at runtime (memory/behavior)

> > tldr → download filter → tag → execution check




create a simple custom loader(or purchase one which is private or not burnt in public) for the payload along with a cloacker or u can use cf aswell for anti-crawler & autocrypti api to generate new build signature per download, this will maintain persistence from chrome/bin download alert and use legitimate name on file (any random name with spaces), this also bypasses chrome alert.

Sometime back I was able to bypass it by directly hosting it on azure file hosting, im not sure if it still works its probably been patched, there were other websites for hosting files that instantly gave reputation to the payload, allowing you to download it without detections, but I don’t seem to remember them.


also another method is


using sigtheif and steal cert from another file and Combine with file packers to make the stolen cert look less out of place.


honestly there are many cheeeky ways to bypass chrome detection, just be creative thats all i can say

all these are things that ive used it for work in the past and not do any guessing game and things worked perfectly.


sideloading is also an option but make sure ur zip file dont get sigged coz then chrome will scream again

if u want to skip all this and take the easy way out just purchase the cert if u have too much money and no time to do all this

furthermore

LNK Stomping
Signed Binary Proxy Execution
Trusted Platform Abuse (Azure, Vercel, Subdomain Hosting *.web.app, *.netlify.app, *.github.io)
clickfix


If there are any repeated methods, I apologize it was 5 a.m. when I was writing this, and I was very tired. I might make a thread about this later.
I_H8_KDot benio2 DramaKing

[Lookdadon]

i never spreaded a payload/file but worked with drainer/phishing which at some point throw the same problems. Very usefull technics was to:
-add a captcha before landing on page so it block google crawlers to access your page/cloudflare setup to block crawlers or even js code that block crawlers.
-write the malicious logic with rust as a wasm and let you have a code that dont need obfuscation other than minify and just use random name for func/variables and etc as the malicious part run in rust wasm who compile in binary which make it unreadable.
-pixel of webpage edited
-convert img and some codes in base64
i know isnt exact same thing when you host a payload but probably at somepoint some technics remain the same i guess... ex:if crawler are blocked by a captcha i guess maybe it could be blocked by a password protected archive or container? but one thing i think burn the shit is all visit come from a link and no organic.

the trusted reputation abuse LOADMAN mentionned was a total game changer for some time. it was totally easier and a good page could last a week or 2, now its rince and repeat very quickly. i found a smart technic somewhere: buy expired domain with big history and backlink etc

hope it give a hint or two

[loadman]

i never spreaded a payload/file but worked with drainer/phishing which at some point throw the same problems. Very usefull technics was to:
-add a captcha before landing on page so it block google crawlers to access your page/cloudflare setup to block crawlers or even js code that block crawlers.
-write the malicious logic with rust as a wasm and let you have a code that dont need obfuscation other than minify and just use random name for func/variables and etc as the malicious part run in rust wasm who compile in binary which make it unreadable.
-pixel of webpage edited
-convert img and some codes in base64
i know isnt exact same thing when you host a payload but probably at somepoint some technics remain the same i guess... ex:if crawler are blocked by a captcha i guess maybe it could be blocked by a password protected archive or container? but one thing i think burn the shit is all visit come from a link and no organic.

the trusted reputation abuse LOADMAN mentionned was a total game changer for some time. it was totally easier and a good page could last a week or 2, now its rince and repeat very quickly. i found a smart technic somewhere: buy expired domain with big history and backlink etc

hope it give a hint or two

angelferno?