Changelog

Console 2.9.3 — October 2026

• Stronger shared threat intelligence: attacker infrastructure seen by many independent browsers now stands out in our research view, so we can spot new campaigns sooner and add them to everyone’s protection.

Research & guides — 30 October 2026

• New plain-language guides: fake CAPTCHAs that ask for Windows + R, what ClickFix is, Device Code phishing in Microsoft 365, AiTM phishing and MFA bypass, EtherHiding, and Chrome’s new ClickFix warning compared with a security extension.
• Research: the SC WordPress backdoor that keeps its command servers on Ethereum — how it works, seven months of its smart contracts’ history, and how to check and clean a site.

Privacy policy, GDPR page and DPA — 29 October 2026

• More detail on what a connected browser sends: how an attack reached the browser, the connection’s IP address, and the optional telemetry an organization can turn on. Nothing new is collected.

Extension 3.7.2 · Console 2.9.2 — October 2026

• Further hardening of the console and the extension, following an independent security review.

Extension 3.7.1 · Console 2.9.1 — October 2026

• Exposure reads the server version from its default error pages when the server hides it elsewhere, and flags that the version is visible.
• More accurate WordPress versions, and honest results when a server shows only part of its version: "version too vague" instead of a guess.
• Vulnerability data says plainly whether anything is needed, and when each source last ran and succeeded.

Extension 3.7.0 · Console 2.9.0 — October 2026

• Which script loaded which: on a compromised site, the attack story and the graph now show the site’s own script that pulled in the attacker’s code, so you know exactly what to clean.
• Campaign map: sites that share the same attacker infrastructure are grouped and drawn together, so one operation behind many sites becomes one finding.
• Notices from us, right in your console: releases, security advisories and maintenance reach your administrators, who close each one when read.
• Threat Events: a faster device search, low-severity events in one click, and the last 24 hours by default.
• Enterprise: Exposure follows more JavaScript frameworks (Astro, Gatsby, SvelteKit, Remix, Docusaurus, Eleventy, VitePress and more) and says clearly when a distribution build may still receive fixes.
• Web Intelligence is now simply Intelligence, and every feature outside your plan shows what it would give you and which plans include it.

Console 2.8.1 — October 2026

• Clearer status of the vulnerability data sources: a source with nothing to check yet says so.

Extension 3.6.0 · Console 2.8.0 — October 2026

• Every attack story now starts where it really began: the search, the e-mail or the site the user came from, and every redirect on the way to the attack page.
• The investigation graph shows who redirected to whom and which site led the user to the attack.
• Enterprise: see the software and versions of the sites your people rely on, their security hygiene and how they change over time, without scanning anyone.
• Enterprise: instant exposure. When a new vulnerability is published, find out at once which sites your people use report an affected version and who opened them, with known exploited vulnerabilities and end of support highlighted.
• Careful by design: reported versions and possible vulnerabilities, never guesses; cookie values, page text and full addresses never leave the browser.

Console 2.7.0 — October 2026

• Share an investigation with your threat intelligence platform: the graph of a site, a device or an incident exports as a STIX 2.1 bundle that MISP, OpenCTI and SIEMs import, with your classification label on every object.
• Devices are pseudonymised by default when you share, and you choose the classification (TLP 2.0 or your own labels).
• The incident export now carries the incident graph: as an image, as data, and as a drawing in the PDF report.

Console 2.6.0 — October 2026

• Investigation graph: from a site, a device, an incident, a command or a campaign, see who is linked to whom, in which order and why, and expand it one click at a time.
• Sites, devices, incidents, copy-paste commands and shared attacker infrastructure (smart contracts, payload hosts, service workers) in one picture, with the evidence behind every link.
• Everyday services are set aside by default so the picture stays readable; export it as an image or as data.
• Attack story on every incident: the attack step by step, from the site to the command and the next stage, and how it ended. Also in the incident export.

Extension 3.5.1 · Console 2.5.1 — October 2026

• A new name: ByteMantle Browser Security & Protection.
• Broader coverage of copy-paste attacks on Windows and macOS, including commands that fetch their next step from a server.
• Pages that try to trap you in full screen are recognised, and the browser is released for you.
• Connection health for administrators: which browsers report, which have gone quiet, and every event that is waiting.

Extension 3.5.0 · Console 2.5.0 — October 2026

• Fewer false alarms: a share or chat icon of a messaging service is no longer taken for the page's sign-in brand, and weak findings are recorded without raising a site's risk.
• Reset risk: an analyst can clear the accumulated risk of a site in the console and in every browser of the organization, with a reason.
• Simpler policy: Balanced or Analyst presets that set the protection switches for you, Analyst records without warning or blocking, and "Off" always means monitor only.
• A switch for blocking the sites in ByteMantle's threat lists, and hints on the Policy page when one setting changes what another does.

Extension 3.4.2 · Console 2.4.2 — October 2026

• Once someone chooses to continue to a site anyway, that site stops repeating its sign-in form warning for a while.
• A smart-contract read alone is no longer escalated as a copy-paste attack chain; a real lure after it still is.
• Service workers that copy sign-in passwords, or reinstall a WordPress plugin with the visitor's session, are recognised as malicious.
• Clearer exports for analysts: rule ids on every sign-in warning, the RPC node and contract of each blockchain read, and device counts per site.
• The console rides out short database restarts at the hosting provider instead of failing the browser's request.

Extension 3.4.1 · Console 2.4.1 — October 2026

• Your organization's trusted websites, set once in the policy and applied by every browser.
• The console shows when the warning page stopped someone (Prevented) and when they chose to continue anyway (Proceeded).
• Fewer false alarms: pages that only talk about copy-paste attacks, and ordinary sign-in pages that resembled a provider's.
• Light theme by default, a clearer console menu that stays as you left it, and a threat counter that keeps counting past 200.

Extension 3.4.0 · Console 2.4.0 — October 2026

• Adversary-in-the-middle sign-in kits are recognised for Microsoft and ten more identity providers (Google, Apple, PayPal, Amazon, Docusign, Dropbox, Facebook, GitHub, Yahoo, Okta), also when the page shows no password field yet.
• Attacks that start on a trusted sharing site and continue in a new tab are followed across tabs, and the console shows where the tab came from.
• Sign-in links made for one person (the e-mail address carried in the link and filled in), one-time-code and QR sign-in pages on brand-new domains.
• What a site asks your wallet to sign is decoded and recorded: unlimited approvals, permits and blind signatures.
• Service workers can be removed from the console for one browser, a group or everyone, or automatically when they are judged malicious.
• Blocking is decided in the policy: how hard known threats are blocked per severity and per group, your own list of blocked sites, “Block this site” in one click, and one message for sites blocked by IT.
• Every table in the console can be sorted by any column.
• Fewer false alarms on real Cloudflare pages and on long articles that describe attacks; the warning page opens only on the tab where the threat was found.
• The page scan costs less on pages that change all the time.

Extension 3.3.0 · Console 2.3.0 — October 2026

• Sign-in protection for the console: every failed sign-in is in the audit log, an account is locked for 15 minutes after five wrong passwords and the administrators are told by e-mail; administrators and our support can unlock it.
• Each organization can allow console sign-in only from its own addresses, network ranges or countries.
• Fewer false alarms: the real “I’m not a robot” checks (reCAPTCHA, hCaptcha, Turnstile) inside a page, the official background workers of Microsoft 365 and Google, and common push-notification services are recognised.
• An event the analyst marked as a false positive no longer opens an incident.
• Every service-worker, domain and Web3 detection has a rule id, so it shows up in the rule analysis export.
• Resource telemetry: the raw records are kept one day by default, the summary of which pages loaded what is kept 90 days for hunting and indicator searches.

Extension 3.2.0 · Console 2.2.0 — October 2026

• Export a whole incident: a PDF report, structured JSON, text ready for an AI assistant (attacker content clearly marked as data) or a ZIP with all three and SHA-256 checksums. A classification label (TLP or your own) is chosen at every export and printed on every page.
• Rule analysis export: every threat event with what each rule matched and the analyst’s verdict, one line per event, to review false alarms.
• Threat indicators: our lists reach every organization and browser automatically, signed; organizations add their own domains, addresses and file hashes, and older events are searched again when a list changes.
• Fewer false alarms on bank and brand sites: official domains and the organization named in the site’s certificate are checked before an impersonation warning.
• Malicious ad-tech infrastructure can be blocked, and hidden ad iframes that lead to attacks are recognized.
• A threat in a background tab no longer pulls that tab to the front.
• Administrators set how often browsers check in; events are sent by severity, with critical ones at once and the rest paced when the console is busy.
• The console keeps up with thousands of browsers: monthly storage of events prepared in the background with no downtime, resource telemetry kept apart, dashboards from hourly counts.
• When a trial or plan ends, the browsers keep the free protection and the console data is kept for 30 days.

Extension 3.1.0 · Console 2.1.0 — October 2026

• Getting started in one tab: after installing, “Accept” opens the free account form right there; a 6-digit code from the e-mail confirms it and the browser is connected at once.
• The free trial includes every browser protection of Pro, and in the console the core views, Web Intelligence and CSV export.
• Console tables: drag a column edge to resize it; your widths follow you to every page and browser. Numbers line up with their headers.
• The extension popup says what actually happened (threats in the last 7 days and the latest one) and links to the Terms and the Privacy policy.
• Signing a browser out of an account asks for a clear confirmation and shows the result.

Extension 3.0.0 · Console 2.0.0 — October 2026

• Your organization’s own warning page, with a one-click “Report to IT”.
• Command Intelligence: every command attackers tried to make users run, decoded and grouped.
• Ready-made dashboards, scheduled reports with a PDF attached, and recipients who confirm by e-mail.
• Two-step sign-in can be required for a whole organization; “My account” in the console.
• Light and dark (Command) themes in the console and the extension; a grouped side menu.
• Detection rules signed by us and checked by the extension.

Extension 2.7–2.14 · Console 1.7–1.14 — October 2026

• Accounts with a free trial, signed plans and policies, and seats per account.
• Groups, rule modes (active, monitor, off) and per-site exceptions pushed to the browsers.
• Service-worker analysis and removal; correlation that survives a browser restart.
• Website age from RDAP, WHOIS and first-seen records, and the “compromised site” label.
• Detection rules shipped as data (219 rules), with a self-test at start-up.

Extension 2.3.37 · Console 1.1.1 — September 2026

• Clipboard analysis expanded to 90 rules across Windows, macOS and Linux, with Base64 and -EncodedCommand decoding.
• Clipboard protection hardened against direct prototype calls and freshly created iframes.
• New: EtherHiding detection and the ClickFix via EtherHiding correlation.
• Device Code coverage extended to Google, GitHub, AWS IAM Identity Center and Okta.
• ClickFix lures recognised in Romanian, German, French, Spanish, Italian, Portuguese, Polish and Dutch.
• Fixed: background clipboard verification now runs on every path.

Extension 2.3.36 · Console 1.1.0 — September 2026

• Diagnostics export in the extension and the console.
• API request log and troubleshooting self-tests in the console.

Extension 2.3.35 · Console 1.0.0 — September 2026

• First release of the console: incidents, Website Intelligence, Web3, hunting, devices and audit log.
• Batched, resilient event delivery from the extension.