They are installing a software package nobody expects and which isn’t need to run a browser.