Tag: browser extension

7 Attack Reports | 0 Vulnerabilities

Attack reports

EmEditor Homepage Download Button Served Malware for 4 Days

Between December 19-22, 2025, EmEditor's official website suffered a security breach, causing the main download button to serve malicious software. The fake installer, signed by WALSHAM INVESTMENTS LIMITED, contained infostealer malware targeting login credentials, browser history, and VPN settings…
infostealer
cryptocurrency
data theft
browser extension
digital signature
2025-12-30
emeditor
website compromise
Published: December 30, 2025
Downloadable IOCs: 1

4.3 Million Browsers Infected: Inside ShadyPanda's 7-Year Malware Campaign

A threat actor named ShadyPanda has been identified as responsible for a seven-year browser extension campaign that has infected 4.3 million Chrome and Edge users. The campaign includes two active operations: a 300,000-user RCE backdoor and a 4-million-user spyware operation. ShadyPanda's extension…
spyware
data exfiltration
malware campaign
chrome
edge
browser extension
trust exploitation
2025-12-03
infinity v+
clean master
wetab
rce backdoor
Published: December 3, 2025
Downloadable IOCs: 0

NodeJS backdoors delivering proxyware and monetization schemes

This report details a campaign involving NodeJS backdoors used to distribute proxyware and monetization schemes. The attackers employ Inno setup installers to drop PowerShell scripts that download and execute NodeJS packages with malicious JavaScript. The backdoors collect system information, commu…
backdoor
powershell
proxyware
browser extension
nodejs
honeygain
infatica
2025-09-24
packetlab
monetization
Published: September 24, 2025
Downloadable IOCs: 0

AppSuite, OneStart & ManualFinder: The Nexus of Deception

This analysis reveals connections between three seemingly distinct malicious programs: AppSuite, OneStart, and ManualFinder. The investigation uncovers shared server infrastructure and similar installation patterns, indicating that these programs are likely created by the same threat actor. OneStar…
powershell
node.js
infrastructure
appsuite
manualfinder
2025-09-16
browser-extension
cloudfront
onestart
desktopbar
browserassistant
Published: September 16, 2025
Downloadable IOCs: 0

Google and Microsoft Trusted Them. 2.3 Million Users Installed Them. They Were Malware.

A coordinated campaign of 18 malicious browser extensions infected 2.3 million users across Chrome and Edge. These extensions, including a color picker tool, appeared legitimate with verified badges and high install counts. The RedDirection campaign implemented sophisticated browser hijacking mecha…
supply chain attack
chrome
edge
browser extension
2025-07-10
reddirection
trust exploitation
verification bypass
Published: July 10, 2025
Downloadable IOCs: 7

Operation Phantom Enigma

A malicious campaign targeting primarily Brazilian residents has been discovered, with attacks detected since early 2025. The attackers employed phishing emails, some sent from compromised company servers, to distribute malware. Two attack chains were identified: one using a malicious browser exten…
phishing
powershell
stealer
banking
browser extension
2025-06-05
mesh agent
pdq connect agent
Published: June 5, 2025
Downloadable IOCs: 0

New Evasive Campaign Delivers LegionLoader via Fake CAPTCHA & CloudFlare Turnstile

A new malicious campaign has been discovered targeting users searching for PDF documents online. The attack uses fake CAPTCHAs and CloudFlare Turnstile to deliver LegionLoader malware, which then installs a malicious browser extension. The infection chain involves a drive-by download, execution of …
phishing
drive-by download
captcha
process hollowing
legionloader
2025-04-05
browser extension
cloudflare turnstile
Published: April 5, 2025
Downloadable IOCs: 5
Click here to see more Attack Reports