InfoSecBulletin Cybersecurity for mankind
A new malware campaign is currently installing fake Google Chrome and Microsoft Edge extensions through a trojan found on fake websites posing as popular software.
“The trojan malware contains different deliverables ranging from simple adware extensions that hijack searches to more sophisticated malicious scripts that deliver local extensions to steal private data and execute various commands,” the ReasonLabs research team said in an analysis.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
“This trojan malware, existing since 2021, originates from imitations of download websites with add-ons to online games and videos.”
The malware and extensions have affected over 300,000 users of Google Chrome and Microsoft Edge, showing a widespread impact.
The campaign uses malvertising to promote fake websites that trick users into downloading a trojan, which then installs browser extensions. These fake websites mimic known software like Roblox FPS Unlocker, YouTube, VLC media player, Steam, and KeePass.
The malicious installers, which are digitally signed, create a scheduled task. This task runs a PowerShell script that downloads and executes a payload from a remote server.
To hijack search queries on Google and Microsoft Bing, extensions from Chrome Web Store and Microsoft Edge Add-ons can be installed by modifying the Windows Registry. These extensions will then redirect the search queries through attacker-controlled servers.
“The extension cannot be disabled by the user, even with Developer Mode ‘ON,'” ReasonLabs said. “Newer versions of the script remove browser updates.”
It additionally activates a locally downloaded extension from a command-and-control (C2) server, which possesses advanced functions to intercept web requests, forward them to the server, receive encrypted commands and scripts, and inject/load scripts on all pages.
On top of that, it hijacks search queries from Ask.com, Bing, and Google, and funnels them through its servers and then on to other search engines.
