Threats Tagged 'browser extensions'

A campaign identified by the Socket Threat Research team involves 19 malicious browser extensions (18 for Chrome, 1 for Edge) active since February 2024. These extensions deliver a modular malware framework that communicates with command and control servers via WebSocket, strips Content Security Policy headers, and uses cross-site scripting (XSS) injection to execute payloads. The primary goal is to steal cryptocurrency wallet secrets and drain crypto assets, as well as harvest credentials. The threat actor either creates malicious extensions from scratch or compromises legitimate extensions with existing user bases, such as the 'Enable Right Click & Copy' extension with tens of thousands of users. The campaign, named 'Superior,' shows sophisticated and evolving capabilities targeting multiple cryptocurrency platforms and exchanges.

The GreedyBear attack group has launched a massive crypto theft operation, utilizing 150 weaponized Firefox extensions, nearly 500 malicious executables, and numerous phishing websites. Their tactics include Extension Hollowing to bypass marketplace security, distributing various malware families, and creating scam sites masquerading as crypto products. The campaign's infrastructure is consolidated to a single IP address, suggesting a centralized backend. The group has expanded from its earlier Foxy Wallet campaign and shows signs of potential growth beyond Firefox. The attackers are leveraging AI to scale their operations, making it challenging for traditional security measures to keep up. The campaign has reportedly stolen over $1 million from victims.

MediumCampaignGermanyUnited KingdomFrance+3#malware#browser extensions#extension hollowing