Brave trying to download random documents from unknown websites while in standby

Description of the issue: While i’m using the laptop as normal during the day, everything works as expected. The problem arises during the night (while my laptop is in standby) because when i wake up the laptop in the morning, Brave asks me to download a random file from a random website (see screenshot attached).

Steps to Reproduce (add as many as necessary): 1. 2. 3. To be honest i have absolutely no idea on how to reproduce this, it happens randomly, like the first time it happened was 4 days ago, the second one tonight.

Actual Result:


As you can see, the Brave icon in the dock has a 1 and once i open it, this is what i see. Clearly i’ve never been to that website (it’s not in my history) so i don’t really understand how it’s possible that my laptop made a request while in standby to that website.

Reproduces how often: Until now, once every 4 days (i’m not switching off the laptop)

Operating System and Brave Version: Brave: 17.74.48, macOS: Sequoia 15.2

Additional Information: I’ve scanned the laptop with Malwarebytes but nothing was found (and all my software is updated to the latest version).

IMMEDIATELY

Go to /Library/LaunchAgents/ and delete any item that has “permeneerr” in its name.

Go to /Library/LaunchDaemons/ and delete any item that has “permeneerr” in its name.

Go to /Library/Caches/ and delete any item that has “permeneerr” in its name.

Go to /Library/Application Support/ and delete any item that has “permeneerr” in its name.

Go to /Library/Preferences/ and delete any item that has “permeneerr” in its name.

Go to /Library/Preferences/SystemConfiguration/ and delete any item that has “permeneerr” in its name.


Edit your hosts file /etc/hosts, include 2 lines:

127.0.0.1 permeneerr.com
127.0.0.1 www.permeneerr.com

https://www.tomsguide.com/how-to/how-to-edit-the-host-file-on-mac


Examine ALL of your Notifications settings for EVERYTHING on your Mac, and disable all . . . except the most essential.

Exit / Quit all applications.

Delete the Caches folder: /Users/your_username/Library/Caches/

Delete the Cookies folder: /Users/your_username/Library/Cookies/

Go to /Users/your_username/Library/Containers/ and delete any item that has “permeneerr” in its name.

Go to /Users/your_username/Library/LaunchAgents/ (if it exists) and delete any item that has “permeneerr” in its name.

Go to /Users/your_username/Library/Preferences/ and delete any item that has “permeneerr” in its name.

Go to /Users/your_username/Library/Application Support/ and delete any item that has “permeneerr” in its name.

Restart your Mac.

DO NOT leave any Internet browser running overnight - nor “in standby.”


Get Little Snitch and learn how to use it:

Create / enable a rule for “Any Process” to DENY inbound traffic from domain: permeneerr.com

Create / enable a rule for “Any Process” to DENY outbound traffic to domain: permeneerr.com


Get Marcel Bresink’s “TinkerTool System 9”

http://www.bresink.com/osx/TinkerToolSys9.html

and use it for thorough cleaning.


Examine any relationships in, and around, whatever might be your connections with:

https://github.com/agda/agda


Thanks a lot, i will do everything you suggested right now.

Just as an additional note i haven’t mentioned in my original post that may change the analysis, the website that tries to download a file is not always the same.
Like this time the website was permeneerr.com, the first time it happened was my university student portal (which i highly think it’s some sort of bug, there’s no way my university portal is doing requests in background). The reason i have no doubt’s about the university students portal is the fact that the file it was trying to download was a finance impact document of the boy scouts of america (once again a .doc file). In the attached screenshot you can see the file it was trying to download


Like how tf is this even possible

Edit: i’m going through all the locations you suggested and there’s nothing related to the domain permeneerr

My guess, is that somehow, a troublesome javascript has been, or is being, downloaded to your Mac. Could be on board, all the time, or is periodically or randomly being downloaded.

Any Playlist type settings, I would disable them. Basically, disable as much “background” processing as you can, at least for the near-term.

Look over your Mac’s Accessibility settings, Security settings.


Another tool for the Mac - EtreCheck:

https://etrecheck.com/en/index.html

https://discussions.apple.com/docs/DOC-6172


But if that was the case, if i close the browser and clear the caches/permanent storage of the browser that should be gone forever right? Because two days ago (so between the first incident and the one of tonight) i’ve rebooted Brave because of an update but as we can see it’s still happening.
I’m also monitoring the network traffic overnight and there’s nothing unusual, just these two random file download requests

There are many sources of javascripts. There are many javascripts.

There are many people who know how to include a “clever” portion within what appears on the surface to be a non-malicious javascript.

Usually, the “victim” of a malicious script, inadvertently, unknowingly, downloaded it by clicking on a link in an e-mail message.