Loader tradecraft and detection evasion

FamousSparrow's fake certificate prompt: one MSI, two backdoors, and a very short hunt rule

Positive Technologies says the East Asian group is injecting JavaScript into legitimate sites to push a bogus certificate that installs SquawkDoor and a reworked SparrowDoor. Four locations are confirmed.