Threats Tagged 'chrome extension'

Kimsuky conducted spear phishing campaigns targeting South Korean and Japanese entities in early 2026. The attacks used LNK malware distributed via OneDrive share links to establish scheduled tasks that periodically retrieved PowerShell scripts from command-and-control servers. These scripts profiled infected systems, exfiltrated email data from Thunderbird and Outlook, and logged keystrokes. The threat actor leveraged legitimate remote control tools such as Chrome Remote Desktop and AnyDesk to evade antivirus detection and maintain persistent access. Additionally, a malicious Chrome extension with AI-generated code was used to steal Gmail data. The operation employed rotating infrastructure and compromised legitimate Korean servers as command-and-control nodes to hinder tracking efforts.

MediumCampaignJapanSouth Korea#spear phishing#chrome remote desktop#powershell

A fraudulent version of the widely-used PC cleaning utility CCleaner is being distributed through a convincing imitation website to deploy GhostDesk, a malicious Chrome extension functioning as spyware. The attack begins when users download the fake application from a lookalike site, which then launches a multi-stage infection using CScript to modify Chrome's Security Extension and install malicious components. Once active, GhostDesk performs extensive surveillance including credential theft, keylogging, screenshot capture, cookie harvesting, and cryptojacking. The extension establishes command-and-control communications via WebSocket connections and can execute arbitrary code within browser tabs. Similar fake versions of other popular software like 7-Zip and Adobe Acrobat have been identified using identical infection techniques.

Microsoft Threat Intelligence identified a malicious Chromium extension spoofing Perplexity AI to deceive users into installation. The extension's primary objective involves search traffic interception and data collection through Manifest Version 3 capabilities and declarativeNetRequest rules. It routes both full search queries and real-time keystrokes through attacker-controlled infrastructure hosted on a typosquatted domain before redirecting to legitimate search providers. The extension overrides browser default search settings, captures user input at keystroke-level, and uses suspicious permissions inconsistent with legitimate AI assistants. The threat demonstrates how actors operationalize AI branding as social engineering vectors. Google removed the extension following responsible disclosure. Organizations should strengthen user awareness training and implement layered security strategies to detect similar threats.

A malicious Chrome extension impersonating Google's Authenticator application has been identified as part of an ongoing campaign active since early 2026. The extension requests excessive permissions and contains dormant infrastructure suggesting a staged deployment model where malicious updates can be delivered without requiring further user approval. This extension is linked to at least six others through a shared developer front, with two already carrying fully operational malicious payloads. These extensions utilize hidden iframes to inject attacker-controlled content, deploy fraudulent paywalls for free services, and maintain bidirectional communication with command and control servers. The infrastructure maps directly to the AiFrame campaign, which has reportedly compromised over 260,000 users from 2025 to present, marking a continued evolution of this threat.

In 2025, AI did not revolutionize cyber attacks as predicted. Instead, adversaries used AI to accelerate traditional tradecraft, focusing on speed and accessibility rather than new offensive capabilities. The article examines several case studies showcasing AI-generated scripts for credential theft and browser exploitation. These attacks, while faster and more accessible to less-skilled operators, still rely on familiar techniques detectable by basic security measures. The outlook for 2026 suggests continued AI-driven commoditization of tradecraft, with more templated attacks and improved phishing attempts. However, fundamental security practices remain effective against these evolving threats.

MediumCampaignGermanyFranceUnited Kingdom+5#chrome extension#tradecraft acceleration#credential theft

A popular Chrome VPN extension, FreeVPN.One, with over 100,000 installs has transformed into spyware. Initially legitimate, the extension began capturing screenshots of users' online activities and collecting sensitive information after an update in April 2025. The spyware operates covertly, automatically taking screenshots of every webpage visited and uploading them to an attacker-controlled domain. It also exfiltrates device and location data at installation and startup. The extension's developer provided evasive responses when confronted, claiming the feature was for background scanning of suspicious domains. This incident highlights the potential risks associated with VPN services and the importance of scrutinizing even seemingly trustworthy browser extensions.

MediumMalwareGermanyFranceUnited Kingdom+4#browser security#screenshot capture#freevpn.one