A campaign targeting the Google Chrome Web Store has deployed over 100 malicious browser extensions masquerading as legitimate tools like VPNs, AI assistants, and crypto utilities. These extensions, while offering some promised functionality, secretly connect to threat actor infrastructure to steal user information and execute remote scripts. They can modify network traffic, deliver ads, perform redirections, and act as proxies. The campaign, discovered by DomainTools researchers, involves numerous fake domains promoting these tools. The extensions request permissions that enable cookie theft, DOM-based phishing, and dynamic script injection. Risks include account hijacking, data theft, and browsing activity monitoring. Some extensions remain on the Chrome Web Store despite Google's removal efforts.
A new Dero mining campaign is infecting containerized Linux environments through exposed Docker APIs. The attack uses two Golang malware components: 'nginx' for propagation and 'cloud' for mining. The 'nginx' malware scans for vulnerable Docker hosts, creates malicious containers, and compromises existing ones. It maintains persistence and spreads without a command-and-control server. The 'cloud' component is a modified DeroHE CLI miner with hardcoded wallet and node addresses. This campaign demonstrates the potential risks of insecurely published Docker APIs and the need for robust container security measures.
An unknown threat actor has been creating malicious Chrome browser extensions since February 2024, using fake websites to lure users into installing them. These extensions have dual functionality, appearing to work as intended while also connecting to malicious servers to steal user data and execute arbitrary code. The extensions request excessive permissions and use various techniques to bypass security measures. They communicate with actor-controlled API domains, sending encrypted system information and receiving dynamic rules and code. The malicious activities include cookie theft, traffic manipulation, and potential account compromises. Over 100 fake websites and extensions have been deployed, exploiting current trends to attract users. The Chrome Web Store has removed some extensions, but the actor's persistence poses an ongoing threat to users seeking productivity tools and browser enhancements.
The CopyRh(ight)adamantys campaign is a large-scale phishing operation distributing the latest Rhadamanthys stealer malware (version 0.7). It uses copyright infringement-themed bait emails impersonating companies mainly in the Entertainment/Media and Technology/Software sectors. The campaign employs automation and possibly AI tools to tailor and distribute lures globally. Rhadamanthys stealer targets sensitive information by leveraging various techniques including OCR-based text recognition and credential theft. Although the malware claims AI-powered capabilities, it primarily uses traditional machine learning OCR methods. The campaign is financially motivated, not linked to nation-state actors, and poses a medium severity threat. European organizations in targeted sectors face risks of data theft and credential compromise. Mitigation requires targeted phishing awareness, enhanced email filtering, endpoint detection, and credential hygiene. Countries with strong media and tech industries and high phishing exposure are most at risk.
