Reddit NetSec

AlienVault OTX General

CVE Database V5

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A coordinated campaign of 18 malicious browser extensions infected 2.3 million users across Chrome and Edge. These extensions, including a color picker tool, appeared legitimate with verified badges and high install counts. The RedDirection campaign implemented sophisticated browser hijacking mechanisms, capturing users' browsing data and potentially redirecting them to malicious sites. The malware was introduced through version updates of previously clean extensions, exploiting the auto-update feature of browsers. The campaign demonstrates systemic failures in marketplace security, verification processes, and trust signals, turning productivity tools into surveillance malware. Users are advised to remove affected extensions and monitor their accounts for suspicious activity.

The RedDirection campaign is a coordinated malware operation involving 18 malicious browser extensions that collectively infected approximately 2.3 million users of Google Chrome and Microsoft Edge browsers. These extensions initially appeared legitimate, featuring verified badges and high installation counts, which helped them evade suspicion. The attackers exploited the browser auto-update mechanism by initially publishing clean versions of these extensions and then pushing malicious updates, effectively bypassing marketplace security and verification processes. The malicious extensions implemented sophisticated browser hijacking techniques, including capturing users' browsing data and redirecting them to attacker-controlled or malicious websites. This campaign highlights systemic weaknesses in browser extension marketplaces, particularly in the verification and trust model, where productivity tools can be weaponized into surveillance malware. Indicators of compromise include specific hashes, URLs, and domains associated with the campaign's command and control infrastructure. The campaign leverages multiple attack techniques such as credential access (T1056.001), command execution (T1059.007), persistence (T1133), user execution (T1204.002), and data exfiltration (T1571), among others. Although no CVE identifiers or known exploits in the wild are reported, the scale of infection and the stealthy nature of the campaign make it a significant threat to users and organizations relying on browser extensions for daily operations.

Detailed information about Google and Microsoft Trusted Them. 2.3 Million Users Installed Them. They Were Malware.. Get real-time updates, technical details, an

Google and Microsoft Trusted Them. 2.3 Million Users Installed Them. They Were Malware. - Live Threat Intelligence - Threat Radar | OffSeq.com

Google and Microsoft Trusted Them. 2.3 Million Users Installed Them. They Were Malware.

A malicious campaign targeting primarily Brazilian residents has been discovered, with attacks detected since early 2025. The attackers employed phishing emails, some sent from compromised company servers, to distribute malware. Two attack chains were identified: one using a malicious browser extension for Google Chrome, Microsoft Edge, and Brave, and another utilizing Mesh Agent or PDQ Connect Agent. The campaign aimed to steal authentication data from victims' bank accounts, particularly targeting Banco do Brasil customers. Over 700 downloads of the malicious extension were recorded, affecting users in Brazil, Colombia, Czech Republic, Mexico, Russia, Vietnam, and other countries. The attackers used sophisticated techniques, including virtualization checks, UAC bypass, and file deletion to evade detection.

Operation Phantom Enigma is a malicious cyber campaign first identified in early 2025, primarily targeting Brazilian residents. The attackers leveraged phishing emails, some originating from compromised corporate email servers, to distribute malware designed to steal banking authentication credentials. The campaign employed two main attack vectors: a malicious browser extension compatible with Google Chrome, Microsoft Edge, and Brave browsers, and exploitation of legitimate remote management tools such as Mesh Agent and PDQ Connect Agent. The browser extension was downloaded over 700 times, indicating a significant infection vector. The primary target was Banco do Brasil customers, with the attackers aiming to harvest login credentials and potentially conduct fraudulent transactions. The campaign also affected users in Colombia, Czech Republic, Mexico, Russia, Vietnam, and other countries, demonstrating a broad geographic reach. The attackers used advanced evasion techniques including virtualization environment detection to avoid sandbox analysis, User Account Control (UAC) bypass to escalate privileges without user consent, and file deletion to remove traces of their activities. These tactics suggest a well-resourced adversary focused on stealth and persistence. The use of legitimate remote management tools as part of the attack chain indicates a sophisticated approach to lateral movement and persistence within compromised networks. The campaign’s medium severity rating reflects the targeted nature of the attacks and the moderate scale of infections, but the potential for significant financial theft and data compromise remains high.

Detailed information about Operation Phantom Enigma. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'browser extension'

Filter Threats

Threats Tagged 'browser extension'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility