Full Report
An unknown threat actor has been attributed to creating several malicious Chrome Browser extensions since February 2024 that masquerade as seemingly benign utilities but incorporate covert functionality to exfiltrate data, receive commands, and execute arbitrary code. "The actor creates websites that masquerade as legitimate services, productivity tools, ad and media creation or analysis
Analysis Summary
# Tool/Technique: Malicious Chrome Extensions (Dual-Function Malware)
## Overview
A campaign involving over 100 malicious Chrome browser extensions masquerading as legitimate utilities (e.g., productivity tools, VPNs, crypto services). These extensions exhibit dual functionality: offering advertised features while covertly stealing credentials, hijacking sessions, injecting advertisements, and executing arbitrary code downloaded remotely.
## Technical Details
- Type: Malware (Browser Extension)
- Platform: Google Chrome Browser (likely affects other Chromium-based browsers)
- Capabilities: Credential theft, cookie theft, session hijacking, ad injection, malicious redirects, traffic manipulation, remote code execution (RCE).
- First Seen: Since February 2024
## MITRE ATT&CK Mapping
This activity primarily targets end-user browsers and relies on stealth and persistence:
- **TA0002 - Execution**
- T1204.002 - User Execution: Malicious File (If the extension download is tricked)
- T1059.005 - Command and Scripting Interpreter: Visual Basic (For code execution via scripts)
- **TA0006 - Credential Access**
- T1555.003 - Credentials from Web Browsers: Extensions
- **TA0011 - Command and Control**
- T1071.001 - Application Layer Protocol: Web Protocols (Establishing WebSocket connection)
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information (Relating to how code fetching might be configured)
## Functionality
### Core Capabilities
1. **Data Exfiltration:** Harvesting browser cookies and user credentials.
2. **Session Hijacking:** Utilizing stolen session information to take over active user sessions.
3. **Ad Injection:** Injecting advertisements into visited websites.
4. **Malicious Redirects:** Controlling user navigation paths.
5. **Traffic Manipulation:** Routing browser traffic potentially through a proxy established via a WebSocket connection.
### Advanced Features
1. **Excessive Permissions:** Requesting broad permissions via `manifest.json` allowing interaction with all visited sites.
2. **Remote Code Execution (RCE):** Fetching and executing arbitrary scripts directly from an attacker-controlled domain.
3. **Evasion Technique:** Utilizing the `onreset` event handler on a temporary DOM element to trigger code execution, possibly to bypass Content Security Policy (CSP).
4. **Persistence/Discovery:** Setting up a WebSocket connection to the C2 server to act as a persistent network proxy.
## Indicators of Compromise
*Note: Specific hashes or C2 domains are not provided in the text, therefore this section remains generalized based on behavioral indicators.*
- File Hashes: [Not specified in the article]
- File Names: [Extensions installed from fake Chrome Web Store listings]
- Registry Keys: [Not typically primary IOCs for Chrome extensions, but manipulation of extension data location may occur]
- Network Indicators:
- Connections to dynamically fetched command and control domains.
- Establishment of **WebSocket connections** for persistent C2 traffic routing.
- Behavioral Indicators:
- Extensions requesting permissions to read and change all data on visited websites.
- Attempts to execute code via the `onreset` event handler on temporary DOM objects.
- Outbound communication to unauthorized remote sites to exfiltrate cookies/credentials.
## Associated Threat Actors
- An **unknown threat actor** has been attributed to this campaign, active since February 2024.
- Over 100 fake websites and malicious extensions have been created.
## Detection Methods
- Signature-based detection: [Not explicitly detailed, but detection signatures could target known extension package structures or C2 communications if domain lists become available.]
- Behavioral detection: Monitoring browser extensions for unusual permission usage, unauthorized remote script fetching, and the use of the `onreset` event for code execution.
- YARA rules: [Not specified in the article]
## Mitigation Strategies
- **User Education:** Users must verify developer trustworthiness before downloading any extension.
- **Permission Scrutiny:** Review all permissions requested by an extension before installation, especially those requesting access to all websites.
- **Review Scrutiny:** Carefully scrutinize user reviews; be aware that ratings may be artificially inflated.
- **Source Verification:** Stick to extensions from verified, well-known developers.
- **Action Taken:** Google has reportedly taken down the identified malicious extensions.
## Related Tools/Techniques
- Browser Hijacking via legitimate-looking extensions (Common supply chain/client-side attack vector).
- Luring users via lookalike websites impersonating legitimate products (e.g., DeepSeek, DeBank, FortiVPN).
- Phishing/Social Media traffic redirection used to drive victims to installation sites.