InfoSecBulletin Cybersecurity for mankind
A new malware campaign is currently installing fake Google Chrome and Microsoft Edge extensions through a trojan found on fake websites posing as popular software.
“The trojan malware contains different deliverables ranging from simple adware extensions that hijack searches to more sophisticated malicious scripts that deliver local extensions to steal private data and execute various commands,” the ReasonLabs research team said in an analysis.
Canada 2nd largest airlines “WestJet” investigates cyberattack disrupting internal systems
Paraguay 7.4 Million Citizen Records Leaked on Dark Web
High-Severity Flaw in HashiCorp Nomad Allows Privilege Escalation
SoftBank: Over 137,000 personal info leaked
Alert
Trend Micro Apex One Flaw Allow Attackers to Inject Malicious Code
Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Action
Adobe Releases Patch Fixing 254 Vulnerabilities With High-Severity Security Gaps
Alert
40,000 + live internet cameras exposed globally !
Microsoft patch Tuesday fix exploited zero-day and 65 vuls patched
84,000+ Roundcube instances vulnerable to actively exploited flaw
“This trojan malware, existing since 2021, originates from imitations of download websites with add-ons to online games and videos.”
The malware and extensions have affected over 300,000 users of Google Chrome and Microsoft Edge, showing a widespread impact.
The campaign uses malvertising to promote fake websites that trick users into downloading a trojan, which then installs browser extensions. These fake websites mimic known software like Roblox FPS Unlocker, YouTube, VLC media player, Steam, and KeePass.
The malicious installers, which are digitally signed, create a scheduled task. This task runs a PowerShell script that downloads and executes a payload from a remote server.
To hijack search queries on Google and Microsoft Bing, extensions from Chrome Web Store and Microsoft Edge Add-ons can be installed by modifying the Windows Registry. These extensions will then redirect the search queries through attacker-controlled servers.
“The extension cannot be disabled by the user, even with Developer Mode ‘ON,'” ReasonLabs said. “Newer versions of the script remove browser updates.”
It additionally activates a locally downloaded extension from a command-and-control (C2) server, which possesses advanced functions to intercept web requests, forward them to the server, receive encrypted commands and scripts, and inject/load scripts on all pages.
On top of that, it hijacks search queries from Ask.com, Bing, and Google, and funnels them through its servers and then on to other search engines.
