☠️ Not All Software Is Safe: How Shadow IT Can Introduce Rootkits into Your Network
Shadow IT doesn’t always look like your typical security breach. Sometimes, it looks like a curious employee downloading a “free web browser” from a legitimate-looking site–maybe even something they found advertised on YouTube or listed in the top search results on Google, thinking they’re downloading something that will help, not hurt.
But sometimes, that “helpful” software found on a reputable website turns into a full-scale compromise, loosing a rootkit that’s all but impossible to remove from your system–AND your network — and you won’t know about it until it’s too late.
🧱 What’s the Risk?
Most people think of Shadow IT as apps like Zoom, Dropbox, or ChatGPT. But what often flies under the radar is downloadable software that mimics legitimate tools and sits in top search results, advertised as a viable, safe software option for you or your organization — while quietly installing rootkits, spyware, or persistent system-level access that could cripple your organization. If you think this could never happen to you, or that we’re being alarmist, consider the years one of our co-founders spent, trying to remove such software from a large corporation’s network after a well-meaning employee downloaded it, leading to critical systems compromise, data leaks, and DDOS attacks. Believe us when we say that shadow IT, and specifically “malvertising” aka maliciously advertised PuPs (potentially unwanted programs) based, seemingly safe software such as Wavebrowser, Secure Search, Search Encrypt, and Webdiscover are extremely serious threats and ones we often see downloaded and deployed by well-meaning employees.
⚠️ Why WaveBrowser (and Tools Like It) Are Dangerous
Using one of the most pernicious and widely advertised PuPs (potentially unwanted programs that don’t appear malicious on the surface but get kernel-level access once downloaded and deployed, and use that as a gateway to install dangerous software, including ransomware) WaveBrowser looks like a lightweight Chromium-based browser. It shows up on:
- CNET
- Softpedia
- FileHippo
- YouTube
- And other “reputable” software hubs, platforms, and legitimate-seeming advertisements
But what users don’t realize is that WaveBrowser installs itself without standard uninstaller controls, replicates background processes, and can open persistent communication channels for outside control.
In other words: it acts like malware.
And because it:
- Doesn’t show up in obvious startup folders
- Masquerades as a “productivity tool”
- Is often downloaded by users in good faith
…it easily fits within the definition of Shadow IT — and slips past even security-conscious teams.
🧠 How It Happens in Real Life
A well-meaning staff member:
- Thinks their browser is broken
- Googles “lightweight Chrome alternative”
- Finds a free download from a “review site” or a YouTube video from a reputable content creator
- Installs it on their work machine
- That device now has a persistent, undetected, unauthorized program with system-level hooks which require and effectively and immediately garner kernel-level access to your device–i.e. higher privileges than even the highest-level device and/or network administrator or super user may have.
In some cases, it can:
- Override default browser settings
- Hijack DNS resolution
- Block endpoint protection processes
- Communicate with command & control (C2) servers
- Reinstall itself after apparent removal
- Open doors online via frequent API calls to sites that contain malware, including phishing websites, data harvesting websites, and even ransomware websites–WaveBrowser persistently REINSTALLS ITSELF when attempts are made to remove it. One of our cofounders recently had to write a custom PowerShell script to remove WaveBrowser from not only a specific device, but from the entire network that device was connected to, as one by one, endpoint by endpoint, server by server, and computer by computer fell prey to WaveBrowser. Fortunately, these clients had skilled IT and cybersecurity professionals looking out for them, and the clients in question were able to be protected.
🔎 What Makes This Shadow IT — Not Just Malware?
Because it looks legitimate, your IT department might not even know it’s there. Heck, some of these PuP/Shadow IT browsers are functional web browsers that users could be utilizing regularly with no idea that the software they are using is dangerous.
- There’s no purchase order
- There’s no endpoint alert (at least not at first, without xdr or edr software deployed across your environment with customized, protective rules set up to prevent the download and deployment of dangerous Shadow IT/PuP software like WaveBrowser, et al)
- It may even pass casual antivirus scans
- And the employees who download and use it genuinely believe they’re using a helpful tool.
This is the intersection of social engineering and Shadow IT — and that’s exactly why managed services and IT solutions hybrids like BTech Solutions LLC are such crucial partners for organizations in 2025 and beyond.
🔐 How BTech Solutions LLC Can Help
We don’t just respond to incidents — we prevent them from happening in the first place.
Our managed IT and security services include:
- Network installation and setup
- Endpoint-level software monitoring
- Network monitoring and xdr
- Unauthorized application detection
- Behavioral flagging for processes like WaveBrowser and other dangerous PuPs
- Quiet investigation and removal of rogue apps that are both automated AND hands on
- End-user education that builds buy-in, not fear
And because our leadership includes active membership in the FBI’s InfraGard program, and experience working with CISA, we stay in tune with real-world malware, PuP, rootkit, and shadow IT trends and intelligence, not just reactive fixes after an attack has already begun.
💡 When You Think You’re Safe, That’s Exactly When You’re Not
You don’t need a disgruntled employee or an external hacker to be vulnerable.
All you/your organization needs is one misconfiguration, one failed update, one download — by someone who is just trying to help.
Shadow IT isn’t always intentional. But it is always dangerous.
Let us help you find what’s hiding in plain sight — and shut it down before it becomes a breach.
Reach out to us here, to get your free network scan with your initial consultation!
Leave a Reply