SecuriTricks - browser extension

That AI Extension Helping You Write Emails? It's Reading Them First

Researchers discovered 18 malicious AI browser extensions masquerading as productivity tools that deliver remote access trojans, meddler-in-the-middle attacks, and infostealers. These extensions exploit the rise of generative AI to target prompts, user behavior, and browser sessions through API int…

genai

remote access trojan

Published: April 30, 2026

Linked vulnerabilities : CVE-2025-55182 (CVSS 10.0)

Downloadable IOCs: 10

Snow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite

Google Threat Intelligence Group identified a sophisticated intrusion campaign by UNC6692 that combined persistent social engineering with custom malware. The attackers impersonated IT helpdesk personnel via Microsoft Teams, leveraging initial email spam campaigns to create urgency. Victims were tr…

cloud infrastructure abuse

microsoft teams phishing

snowbasin

snowbelt

snowglaze

Published: April 23, 2026

Downloadable IOCs: 7

Google and Microsoft Trusted Them. 2.3 Million Users Installed Them. They Were Malware.

A coordinated campaign of 18 malicious browser extensions infected 2.3 million users across Chrome and Edge. These extensions, including a color picker tool, appeared legitimate with verified badges and high install counts. The RedDirection campaign implemented sophisticated browser hijacking mecha…

Published: July 10, 2025

Downloadable IOCs: 7

Operation Phantom Enigma

A malicious campaign targeting primarily Brazilian residents has been discovered, with attacks detected since early 2025. The attackers employed phishing emails, some sent from compromised company servers, to distribute malware. Two attack chains were identified: one using a malicious browser exten…

Published: June 5, 2025

Downloadable IOCs: 0

New Evasive Campaign Delivers LegionLoader via Fake CAPTCHA & CloudFlare Turnstile

A new malicious campaign has been discovered targeting users searching for PDF documents online. The attack uses fake CAPTCHAs and CloudFlare Turnstile to deliver LegionLoader malware, which then installs a malicious browser extension. The infection chain involves a drive-by download, execution of …

Published: April 5, 2025

Downloadable IOCs: 5

Tag: browser extension

Attack reports

That AI Extension Helping You Write Emails? It's Reading Them First

Snow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite

GlassWorm attack installs fake browser extension for surveillance

Malicious AI Assistant Extensions Harvest LLM Chat Histories

New Clickfix variant 'CrashFix' deploying Python Remote Access Trojan

A $6,000 Russian Malware Toolkit with Chrome Web Store Guarantee

Dissecting CrashFix: A New Toy

EmEditor Homepage Download Button Served Malware for 4 Days

4.3 Million Browsers Infected: Inside ShadyPanda's 7-Year Malware Campaign

NodeJS backdoors delivering proxyware and monetization schemes

AppSuite, OneStart & ManualFinder: The Nexus of Deception

Google and Microsoft Trusted Them. 2.3 Million Users Installed Them. They Were Malware.

Operation Phantom Enigma

New Evasive Campaign Delivers LegionLoader via Fake CAPTCHA & CloudFlare Turnstile