royalcuts.co.uk: a barber shop site that served fake Chrome installers and CoinMiner files, and what to do

What royalcuts.co.uk is, and what we know about it

royalcuts.co.uk is a web address, not a program on your PC. Its home page presents a barber shop in the UK, but the abuse.ch project URLhaus lists five Windows program files on it as malware downloads. Two are tagged CoinMiner, and three carry names that copy Google Chrome installers.

If you only saw the name in a warning, a firewall log or a blocked link, nothing was installed on your PC by that. If you downloaded and opened one of the .exe files, treat the Windows PC as infected and follow the plan on this page. If you own the site, it was most likely broken into, and the section for owners shows the order of the clean-up.

1. 1

   What URLhaus lists

   Five file addresses at the root of royalcuts.co.uk. Four were added on 21 September 2026 within ten seconds of each other, at 13:01 UTC. The fifth, google.exe, was added on 24 September 2026 at 13:37 UTC. One reporter, adrian__luca, submitted all five.

2. 2

   What the names say

   ChromeSetup.exe is the real name of Google's Chrome installer for Windows, and Chrome.exe is the name of the browser program itself. google.exe, Setup.exe and 3.exe are generic. Copying a famous name is the oldest trick for making a download look safe.

3. 3

   What the tags say

   Chrome.exe and 3.exe carry the tag CoinMiner, which marks a program that mines cryptocurrency with your computer. The other three have no tag, so we cannot say which family they belong to. All five have the threat type malware_download.

4. 4

   Where things stand now

   URLhaus marked all five files offline when we read the data on 10 October 2026. The home page still answered our plain request with the barber shop title. An offline file is gone from that address, but a PC that already ran it is not cleaned by that.

Kind of threat

A malware download address on what looks like a small business website; five Windows .exe files, two tagged CoinMiner

File names

ChromeSetup.exe, Chrome.exe, google.exe, Setup.exe, 3.exe, all at the site root

First and last report

21 September 2026 and 24 September 2026

Domain registration

Not available: our lookup returned no RDAP data for this .co.uk name, so we give no registration date

Systems at risk

Windows only, by the .exe ending; no source says Mac or phones are affected

What we checked on 10 October 2026, and what we could not

Our server sent one plain request to https://royalcuts.co.uk/ on 10 October 2026. There was no browser, no clicks and no screenshot. The server, which identifies itself as nginx, answered with status 200 and the page title Royal Cuts, Best Barber Shop in UK, Professional Haircut and Grooming Services. A normal-looking answer clears nothing.

What happened to royalcuts.co.uk, in dates

The history we can document is four days long. The dates come from our copy of the URLhaus data and from our own request.

1. 21 September 2026, 13:01 UTC

   Four files are reported in one minute

   Setup.exe, ChromeSetup.exe, 3.exe and Chrome.exe are added to URLhaus between 13:01:14 and 13:01:24. 3.exe and Chrome.exe get the tag CoinMiner. A batch like this suggests the reporter found the files together, for example in one sample or one folder listing.

2. 24 September 2026, 13:37 UTC

   A fifth file appears

   google.exe is added by the same reporter, three days later and without a tag. A new file after the first reports suggests that whoever placed them still had access to the server on that day. That is our reading, not a fact from a source.

3. By 10 October 2026

   All five are offline

   URLhaus shows every file as offline. Either the files were deleted, or the server stopped handing them out. We do not know who removed them.

4. 10 October 2026

   Our plain request

   The home page answers with status 200 and the barber shop title. We give no registration date because our lookup returned no RDAP data for the name.

We did not read the URLhaus website pages themselves, because they ask for a browser check. The entries above come from the same data in our own copy of the feed, which the server gave us with this job.

What a CoinMiner is, and how fake Chrome installers have spread miners

Microsoft describes CoinMiner as a trojan that uses your PC to mine cryptocurrency for someone else. Bitdefender has reported a campaign in which hacked websites showed fake Chrome update messages that delivered a Monero miner. That campaign is not proven to be this site; it shows how such a trap works.

A miner does not usually lock your files or show a ransom note. Its cost is quieter: electricity, heat, a fan that never stops, a slower PC and wear on the processor or graphics card. The bigger worry is the three untagged files. A program that calls itself Setup.exe can install anything, so a miner may not be the only thing on a PC that ran one.

The five files: what each name suggests, and what we do not know

The names are all we have for three of the files. The table says what each name copies and what is known about it.

If you have one of these names in your Downloads folder, check where it came from before you open it. Right-click the file, choose Properties and look at the Digital Signatures tab. A real Chrome installer is signed by Google LLC. A file with no signature, or a signature from another name, is not Chrome. Do not run it to find out.

What this can cost you

Reading the site name or seeing a block warning costs nothing. The risks below apply to a Windows PC where one of the five files was downloaded and opened.

• High

  A hidden program that uses your hardware

  A miner runs the processor or graphics card hard for hours. That means a slower PC, more heat, a louder fan, a higher power bill and, on a laptop, a battery that drains fast.

• High

  Something more than a miner

  Three files have no tag. An installer from an attacker can add other programs, such as a password stealer or a remote access tool. Until you know otherwise, treat saved passwords on that PC as exposed.

• Medium

  A miner that comes back

  Miners often add a startup entry or a scheduled task so they start again after a restart. Deleting the file you downloaded does not remove those.

• Medium

  Work PCs and shared networks

  On a work PC, tell your IT team at once. A miner on one machine can be a sign that others on the network were reached the same way.

• Low

  Nothing, if you only saw the name

  A name in a warning, a firewall log or a blocked download is not an infection.

What you may notice, and what you may not

Miners are built to stay unseen, but they cannot hide the work they do. The signs below follow from Microsoft's description of CoinMiner and from how miners use a PC.

How people could end up running one of these files

We do not know how visitors reached these five files, and no source says. The routes below are common ways a download on a hacked business site reaches a PC, based on the names and on the Bitdefender report.

1. 1

   A fake update message on a website

   A page you visit says Chrome failed to update and offers an update package. The download link points to a file such as ChromeSetup.exe on a site like this one. Real Chrome updates happen inside the browser.

2. 2

   A link in an email or a chat message

   The link goes straight to an .exe on a real UK business domain, which passes a quick look. The message may promise a missing browser component or a document viewer.

3. 3

   A search result or an ad for Chrome

   Someone looking for a Chrome download clicks a result that is not google.com. The file has the right name and the wrong source.

4. 4

   A file dropped by another program

   A first piece of malware can download the next one from a hacked server. In that case you never clicked these addresses, and the first program is the real problem.

Check your Windows PC before you delete anything

Start with one question: did you open an .exe file that came from royalcuts.co.uk? If yes, follow the whole plan, because a quiet check does not clear a PC. If you are not sure, do these checks first. None of them deletes anything.

While you check, stop using the PC for banking, email and work, and disconnect it from Wi-Fi and the network cable if you can.

1. 1

   Look at Task Manager

   Press Ctrl + Shift + Esc, open the Processes tab and sort by CPU. Right-click any unknown process with high use and choose Open file location. Note the folder; a program in AppData or Temp with a system name is suspect.

2. 2

   Check Windows Security

   Open Windows Security > Virus & threat protection > Protection history. Look for a CoinMiner name or any detection dated around the time you opened the file. On Windows 10 the app is also reached from Settings > Update & Security > Windows Security.

3. 3

   Look at Startup apps

   Open Settings > Apps > Startup on Windows 11. On Windows 10 use the Startup tab in Task Manager. Note any entry you do not recognise.

4. 4

   Look in Task Scheduler

   Press the Windows key, type Task Scheduler and open it. Select Task Scheduler Library and read the names and the Actions tab of any task that is new or has a random name. Note it; do not delete it yet.

5. 5

   Look at Installed apps

   Open Settings > Apps > Installed apps and sort by install date. Anything installed on the day you opened the file that you did not choose is suspect.

Remove it: the order that works

Follow the steps in this order. A miner can come back from a startup entry or a task, so the offline scan comes after you have seen what is there, and a reset is the end of the plan when doubt remains.

1. 1

   Uninstall what you did not choose

   In Settings > Apps > Installed apps, select the three dots next to an unknown program and choose Uninstall. On Windows 10 use Settings > Apps > Apps & features. Then delete the downloaded .exe from your Downloads folder and empty the Recycle Bin.

2. 2

   Switch off what starts with Windows

   In Settings > Apps > Startup, switch off the entries you noted. In Task Scheduler, right-click a task you noted and choose Disable. Disable first; delete after the scan agrees.

3. 3

   Run a full scan

   Open Windows Security > Virus & threat protection > Scan options, choose Full scan and select Scan now. Microsoft's page for CoinMiner advises a full scan because it may find other hidden malware. Make sure Cloud-delivered protection is on under Virus & threat protection settings.

4. 4

   Change passwords from another device

   Use a phone or a different computer. Change your email password first, then banking, then the rest, and turn on two-step sign-in. Do this because the untagged files could have taken more than processor time.

Scan from outside Windows: Microsoft Defender Offline

An offline scan starts before the normal Windows loads, so a program that hides inside Windows has a harder time hiding from it. Microsoft says it targets malware that tries to bypass the Windows shell.

1. 1

   Prepare

   Save your work and close programs. Microsoft says the scan takes about 15 minutes and restarts the PC. You need an administrator account and the Windows Recovery Environment turned on. To check, open Command Prompt as administrator and run reagentc /info; if it says Disabled, run reagentc /enable.

2. 2

   Suspend BitLocker if it is on

   If BitLocker protects the system drive, suspend it first. Otherwise the PC may ask for your recovery key when it restarts into the scan.

3. 3

   Start the scan

   Open Windows Security > Virus & threat protection > Scan options. Choose Microsoft Defender Offline scan and select Scan now, then Scan, then Yes. Windows signs you out, runs the scan and starts again when it ends.

4. 4

   Read the result

   Open Windows Security > Virus & threat protection > Protection history. Microsoft says the offline scan works on x64 Windows 11 and on Windows 10, not on ARM Windows, and that Microsoft Defender Antivirus must be the main antivirus.

5. 5

   Reset if doubt remains

   If something was found and you are not sure everything went, back up your documents to an external disk and open Settings > System > Recovery > Reset this PC. Choose Remove everything after a real infection; do not restore old programs from the backup.

If you own or manage royalcuts.co.uk or another hacked site

Program files at the root of a barber shop website mean someone had write access to the server. We do not know which system the site runs on. The WordPress.org guide to hacked sites gives an order that fits most sites, and a clean-up that skips the way in will be undone.

1. 1

   Write down what you saw and take a copy

   WordPress.org advises a note of what you saw and when, and a snapshot of the site even while infected, before the clean-up. Here the notes start with the five .exe names and the dates 21 and 24 September 2026.

2. 2

   Tell your host and lock every door

   Ask the host whether other sites on the account are hit and what their logs show for those dates. Change every access point for every user: SFTP or FTP, the hosting control panel, the database and the site admin. On WordPress, replace the secret keys in wp-config.php so every logged-in session ends.

3. 3

   Scan your own computer first

   WordPress.org says attacks often start on the site owner's own machine, with trojans that capture FTP and admin logins. Run a full scan on every computer used to manage the site, with a second scanner if you can.

4. 4

   Delete the files and look for more

   Remove the five .exe files and any other program file in the web root or uploads. Check .htaccess, which WordPress.org names as the file most often changed, and index.php, header.php, footer.php and functions.php. Remove any admin user you did not add.

5. 5

   Replace core files from a clean copy

   On WordPress, download the same version you run and copy /wp-admin and /wp-includes over by SFTP. Do not use the reinstall button in the dashboard; WordPress.org says it only overwrites existing files, and hacks add new ones.

6. 6

   Update, change passwords again and watch

   When the site is clean, update the system, themes and plugins, and change all passwords again. Register the site with Google Search Console and Bing Webmaster Tools, as WordPress.org suggests, to see blocklist warnings early. Ask URLhaus to review the entries once the files are gone.

If you use a Mac, an iPhone or an Android phone

The five files are Windows programs by their .exe ending. We found nothing that says they run on anything else.