Tag: chrome

5 Attack Reports | 0 Vulnerabilities

Attack reports

Google and Microsoft Trusted Them. 2.3 Million Users Installed Them. They Were Malware.

A coordinated campaign of 18 malicious browser extensions infected 2.3 million users across Chrome and Edge. These extensions, including a color picker tool, appeared legitimate with verified badges and high install counts. The RedDirection campaign implemented sophisticated browser hijacking mecha…
supply chain attack
chrome
edge
browser extension
2025-07-10
reddirection
trust exploitation
verification bypass
Published: July 10, 2025
Downloadable IOCs: 7

Inside Kimsuky’s Latest Cyberattack: Analyzing Malicious Scripts and Payloads

Kimsuky, also known as “Black Banshee,” a North Korean APT group active at least from 2012, is believed to be state-sponsored. Their cyber espionage targets countries like South Korea, Japan, and the U.S. Their tactics include phishing, malware infections (RATs, backdoors, wiper malware), supply ch…
kimsuky
rats
zip file
chrome
file
2025-03-27
firefox
edge
naver whale
c2 command
black banshee
apt group
64677cae14a2ec4d393a81548417b61b
Published: March 27, 2025
Downloadable IOCs: 0

Regarding the Cyberhaven chrome extension compromise, there are other...

Several Chrome extensions have been compromised, including those related to Cyberhaven. The affected extensions are linked to multiple suspicious domains resolving to the same IP address as cyberhavenext[.]pro. Some confirmed compromised extensions are listed with their corresponding URLs. Users ar…
chrome
2024-12-27
browser extensions
cyberhaven
Published: December 27, 2024
Downloadable IOCs: 14

Cyber startup employee hacked to distribute malicious Chrome extension

Several Chrome extensions have been compromised, including those related to Cyberhaven. The affected extensions are linked to multiple suspicious domains resolving to the same IP address as cyberhavenext[.]pro. Some confirmed compromised extensions are listed with their corresponding URLs. Users ar…
chrome
2024-12-27
browser extensions
cyberhaven
Published: December 27, 2024
Downloadable IOCs: 1

Glove Stealer bypasses Chrome's App-Bound Encryption to steal cookies

Researchers have discovered a new .NET-based information stealer called Glove Stealer that targets browser extensions and local software to steal sensitive data like cookies, passwords, and cryptocurrency wallets. It uses a novel technique to bypass Chrome's App-Bound encryption by exploiting the I…
malware
phishing
information stealer
2024-11-16
chrome
encryption bypass
glove stealer
Published: November 16, 2024
Downloadable IOCs: 0
Click here to see more Attack Reports