InfoSecBulletin Cybersecurity for mankind
A new malware campaign is currently installing fake Google Chrome and Microsoft Edge extensions through a trojan found on fake websites posing as popular software.
“The trojan malware contains different deliverables ranging from simple adware extensions that hijack searches to more sophisticated malicious scripts that deliver local extensions to steal private data and execute various commands,” the ReasonLabs research team said in an analysis.
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
“This trojan malware, existing since 2021, originates from imitations of download websites with add-ons to online games and videos.”
The malware and extensions have affected over 300,000 users of Google Chrome and Microsoft Edge, showing a widespread impact.
The campaign uses malvertising to promote fake websites that trick users into downloading a trojan, which then installs browser extensions. These fake websites mimic known software like Roblox FPS Unlocker, YouTube, VLC media player, Steam, and KeePass.
The malicious installers, which are digitally signed, create a scheduled task. This task runs a PowerShell script that downloads and executes a payload from a remote server.
To hijack search queries on Google and Microsoft Bing, extensions from Chrome Web Store and Microsoft Edge Add-ons can be installed by modifying the Windows Registry. These extensions will then redirect the search queries through attacker-controlled servers.
“The extension cannot be disabled by the user, even with Developer Mode ‘ON,'” ReasonLabs said. “Newer versions of the script remove browser updates.”
It additionally activates a locally downloaded extension from a command-and-control (C2) server, which possesses advanced functions to intercept web requests, forward them to the server, receive encrypted commands and scripts, and inject/load scripts on all pages.
On top of that, it hijacks search queries from Ask.com, Bing, and Google, and funnels them through its servers and then on to other search engines.
