Tag: browser extensions

6 Attack Reports | 0 Vulnerabilities

Attack reports

650 Attack Tools, One Coordinated Campaign

The GreedyBear attack group has launched a massive crypto theft operation, utilizing 150 weaponized Firefox extensions, nearly 500 malicious executables, and numerous phishing websites. Their tactics include Extension Hollowing to bypass marketplace security, distributing various malware families, …
malware
phishing
ransomware
lummastealer
browser extensions
crypto theft
2025-08-08
luca stealer
extension hollowing
scam websites
Published: August 8, 2025
Downloadable IOCs: 111

Exploring a New KimJongRAT Stealer Variant and Its PowerShell Implementation

This article analyzes two new variants of the KimJongRAT stealer: a Portable Executable (PE) variant and a PowerShell implementation. Both variants use a multi-stage infection process, starting with a Windows shortcut (LNK) file that downloads a dropper from a content delivery network. The PE varia…
powershell
cryptocurrency
stealer
multi-stage infection
browser extensions
2025-06-17
kimjongrat
content delivery network
Published: June 17, 2025
Downloadable IOCs: 0

Silent Credit Card Thief Uncovered

A sophisticated credit card skimming campaign dubbed 'RolandSkimmer' has been discovered, targeting users in Bulgaria. The attack utilizes malicious browser extensions across Chrome, Edge, and Firefox, initiated through a deceptive LNK file. The malware employs obfuscated scripts to establish persi…
persistence
lnk file
evasion techniques
browser extensions
obfuscated scripts
2025-04-04
credit card skimming
financial data theft
rolandskimmer
bulgaria
Published: April 4, 2025
Downloadable IOCs: 0

Targeted supply chain attack against Chrome browser extensions

In December 2024, a threat actor successfully compromised around a dozen legitimate Chrome browser extensions by exploiting extension developers' permissions gained through phishing attacks. The malicious code injected into the compromised extensions aimed to harvest sensitive user data like API ke…
phishing
supply chain
credentials
browser extensions
2025-01-22
data harvesting
Published: January 22, 2025
Downloadable IOCs: 80

Regarding the Cyberhaven chrome extension compromise, there are other...

Several Chrome extensions have been compromised, including those related to Cyberhaven. The affected extensions are linked to multiple suspicious domains resolving to the same IP address as cyberhavenext[.]pro. Some confirmed compromised extensions are listed with their corresponding URLs. Users ar…
chrome
2024-12-27
browser extensions
cyberhaven
Published: December 27, 2024
Downloadable IOCs: 14

Cyber startup employee hacked to distribute malicious Chrome extension

Several Chrome extensions have been compromised, including those related to Cyberhaven. The affected extensions are linked to multiple suspicious domains resolving to the same IP address as cyberhavenext[.]pro. Some confirmed compromised extensions are listed with their corresponding URLs. Users ar…
chrome
2024-12-27
browser extensions
cyberhaven
Published: December 27, 2024
Downloadable IOCs: 1
Click here to see more Attack Reports