Full Report
Learn how threat actors leverage browser extensions as an attack vector, including examples for Cyberhaven and GraphQL Network Inspector.
Analysis Summary
The provided article snippet focuses on the threat landscape posed by malicious browser extensions and mentions a separate article regarding the malware triage tool, Assemblyline. Since the request is to summarize information based on the provided context, I will focus on the actionable details concerning browser extensions, specifically mentioning the mentioned examples and the associated malware (Rilide).
# Tool/Technique: Malicious Browser Extensions (General Threat Vector)
## Overview
Browser extensions serve as a growing attack vector leveraged by threat actors. They are small applications, typically written in HTML, CSS, or JavaScript, that add functionality to web browsers. Attacks can stem from compromising existing plugins (e.g., by exploiting vulns or developer accounts) or by designing malware that operates specifically as an extension.
## Technical Details
- Type: Technique / Malware Delivery Mechanism
- Platform: Web Browsers (Chrome mentioned specifically)
- Capabilities: Keylogging, information theft, data exfiltration via compromised extension logic or upstream libraries.
- First Seen: Ongoing/Recent incident context suggests compromises occurring around January 2025.
## MITRE ATT&CK Mapping
Specific mappings for the *general technique* of using malicious extensions are often related to initial access or execution:
- **TA0001 - Initial Access**
- T1189 - Drive-by Compromise (If used to trick users into installation)
- **TA0002 - Execution**
- T1204.002 - User Execution: Malicious File (If installation package is malicious)
- **TA0010 - Exfiltration**
- T1041 - Exfiltration Over C2 Channel (If extensions funnel stolen data out)
## Functionality
### Core Capabilities
- Providing additional functionality within a browser (legitimate use).
- Executing malicious code (Content Scripts, Service Workers) upon page load or browser events.
- Collecting sensitive information (e.g., keylogging capabilities mentioned in the context of the Cyberhaven compromise).
### Advanced Features
- Leveraging browser APIs permitted via the extension manifest file.
- Utilizing Service Workers for background processing.
- Injecting Content Scripts to read or modify page DOM.
## Indicators of Compromise
Indicators are heavily dependent on the specific compromised or malicious extension.
- File Hashes: Not provided in context.
- File Names: Specific file names within extension directories are implementation-dependent.
- Registry Keys: Not provided in context.
- Network Indicators: Not explicitly provided for the general threat, but implied communication channels exist for C2/exfiltration.
- Behavioral Indicators: Overly broad permission requests, unusual network activity originating from extension processes, modification of web page content.
## Associated Threat Actors
Threat actors are utilizing this vector but specific groups are not named as deploying this general technique, beyond the implied actors behind the specific compromised extensions.
## Detection Methods
- Signature-based detection: Monitoring known malicious extension IDs or hashes if signatures exist.
- Behavioral detection: Monitoring service workers or content scripts for suspicious API calls (e.g., key logging, accessing sensitive storage, unauthorized network requests).
- YARA rules: Not provided in context.
## Mitigation Strategies
- Reviewing extension permissions rigorously before installation.
- Enforcing policies in corporate environments regarding approved extensions.
- Regularly reviewing installed extensions and removing unused ones.
## Related Tools/Techniques
- **Rilide:** Mentioned as an example of malware deployed specifically *as* an information-stealing browser extension. Techniques used by Rilide are inherently linked to this vector.
***
# Tool/Technique: Rilide
## Overview
Rilide is an information stealer that functions specifically by deploying itself as a malicious browser extension.
## Technical Details
- Type: Malware family (Information Stealer)
- Platform: Web Browsers (Details on which browser variant is not provided in context, but it is an extension).
- Capabilities: Information stealing, likely credential harvesting, and other data exfiltration functions typical of InfoStealers.
- First Seen: Not specified in context.
## MITRE ATT&CK Mapping
As an information stealer deployed via this vector:
- **TA0009 - Collection**
- T1056.001 - Input Capture: Keylogging
- **TA0010 - Exfiltration**
- T1041 - Exfiltration Over C2 Channel
## Functionality
### Core Capabilities
- Operating as a seemingly legitimate or disguised browser extension.
- Stealing sensitive information accessible via browser contexts.
### Advanced Features
- Not detailed in the provided context.
## Indicators of Compromise
- File Hashes: Not provided in context.
- File Names: Not provided in context.
- Registry Keys: Not provided in context.
- Network Indicators: Not provided in context.
- Behavioral Indicators: Exfiltrating stored browser data or intercepted credentials.
## Associated Threat Actors
- Not specified in the provided context.
## Detection Methods
- Behavioral analysis to detect data staging and subsequent unauthorized external network connections by extension processes.
- Manifest file analysis for excessive or suspicious permissions requesting access to sensitive sites or data.
## Mitigation Strategies
- Strict vetting of all browser extensions.
- Least privilege approach to extension permissions management.
## Related Tools/Techniques
- Other browser-based information stealers (e.g., specialized variants of StealC, Vidar deployed via extension).
***
# Tool/Technique: Cyberhaven Extension Compromise
## Overview
This refers to a specific, known compromise where the Cyberhaven browser extension was modified post-deployment by threat actors to include malicious capabilities, such as keylogging. This was achieved by compromising the existing plugin/developer account.
## Technical Details
- Type: Compromised Legitimate Software (Cyberhaven Extension)
- Platform: Web Browsers (Chrome implied)
- Capabilities: Keylogging added to the legitimate functionality.
- First Seen: Incident context points to compromises identified around January 2025.
## MITRE ATT&CK Mapping
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information (Modifying existing, trusted code)
- **TA0009 - Collection**
- T1056.001 - Input Capture: Keylogging
## Functionality
### Core Capabilities
- Maintaining the original, benign functionality of the Cyberhaven extension.
- Executing newly injected malicious code (keylogging).
### Advanced Features
- Leveraging the implicit trust associated with an already installed and functioning extension.
## Indicators of Compromise
- File Hashes: Not provided in context.
- File Names: Not provided in context.
- Registry Keys: Not provided in context.
- Network Indicators: Not provided in context.
- Behavioral Indicators: Evidence of keylogging activity or background processes monitoring keystrokes or data entry on sensitive pages.
## Associated Threat Actors
- Threat actors responsible for compromising the developer account or exploiting vulnerabilities allowing code injection. (Not named in context).
## Detection Methods
- Code integrity monitoring of installed extension files (hash comparison against known good versions).
- Monitoring for process-level keylogging API calls originating from browser extension processes.
## Mitigation Strategies
- Developer supply chain security (protecting developer accounts/source repositories).
- Users verifying updates frequently come from trusted sources or manually inspecting extension changes/permissions after updates.
## Related Tools/Techniques
- Upstream Library Compromise: Mentioned as an alternative method for injecting malicious code into benign plugins.
***
# Tool/Technique: GraphQL Network Inspector Extension Compromise
## Overview
This refers to a specific, known incident where the GraphQL Network Inspector extension was compromised and leveraged by threat actors (incident in January 2025 context). The provided code snippet suggests complex network sniffing and data exfiltration related to GraphQL queries.
## Technical Details
- Type: Compromised Legitimate Software (GraphQL Network Inspector Extension)
- Platform: Web Browsers (Chrome implied)
- Capabilities: Intercepting and processing GraphQL network traffic, potentially encoding, staging, and exfiltrating request variables (`graphqlnetwork-rtext`, `graphqlnetwork-rjson`, `graphqlnetwork-validate`).
- First Seen: Incident context points to compromises identified around January 2025.
## MITRE ATT&CK Mapping
This tool is highly focused on network interaction and data stealing:
- **TA0009 - Collection**
- T1005 - Data from Local System (Gathering data from browser context)
- **TA0010 - Exfiltration**
- T1041 - Exfiltration Over C2 Channel
## Functionality
### Core Capabilities
- Intercepting web requests, specifically looking for encoded data structures. The code shows use of `atob()` and `btoa()` for decoding/encoding (e.g., `d` and `a` variables).
- Communication via `chrome.runtime.sendMessage` to handle different actions (`graphqlnetwork-rtext`, `graphqlnetwork-rjson`, `graphqlnetwork-validate`).
- Storing local data (`graphqlnetwork_ext_log`) for potential staging or correlation.
### Advanced Features
- Specific handling of GraphQL traffic, using base64 encoding manipulation (`btoa(a)`, `btoa(c)` sent in the validation step).
- Sending structured payloads (including `openapi_tk`, `graphqlnetwork_cx`, `gpta`, `uid`) to external locations defined by URLs `s`, `c`, and `m`.
## Indicators of Compromise
Technical indicators are embedded in the JavaScript logic provided:
- File Hashes: Not provided in context.
- File Names: Not provided in context.
- Registry Keys: Not provided in context.
- Network Indicators: All C2/reporting URLs are represented by variables: `s`, `c`, `m`, `l`, `t`. These need resolving from the actual extension payload. The commands suggest specific actions on these endpoints (e.g., `graphqlnetwork-rjson`).
- Behavioral Indicators: Excessive use of Chrome runtime messaging for data transmission, frequent network interception, and storage manipulation via `chrome.storage.local.set`.
## Associated Threat Actors
- Threat actors responsible for the compromise of the GraphQL Network Inspector extension. (Not named in context).
## Detection Methods
- Monitoring extension backgrounds scripts for heavy cryptographic/encoding operations combined with frequent `chrome.runtime.sendMessage` calls related to network data transmission.
- Analyzing extension permissions versus demonstrated network activity.
## Mitigation Strategies
- Immediate removal of the compromised extension if identified.
- Network security monitoring to detect beaconing or strange traffic patterns associated with extension processes communicating over the internet.
## Related Tools/Techniques
- Other malicious extensions that rely on credential or application-specific data harvesting using browser APIs.
***
# Tool/Technique: Assemblyline
## Overview
Assemblyline is an open-source tool designed for malware triage.
## Technical Details
- Type: Tool (Malware Triage Platform)
- Platform: General (Installation walkthrough provided)
- Capabilities: Automated analysis and triaging of malware samples.
- First Seen: Article published in January 2025, tool release/discussion prior to that.
## MITRE ATT&CK Mapping
This is a defensive tool, mapped to defensive tactics:
- **TA0000 - Defensive Tactics** (If mapped specifically, often falls under Analysis or Investigation)
## Functionality
### Core Capabilities
- Installation and deployment for analysis workflows.
- Providing an example use case for malware triage.
### Advanced Features
- Open-source nature allows for community contributions and customization.
## Indicators of Compromise
- Not applicable (It is a legitimate security tool).
## Associated Threat Actors
- Not applicable (It is a defensive security tool).
## Detection Methods
- Not applicable.
## Mitigation Strategies
- **Installation and usage guidelines provided in the linked resource.**
## Related Tools/Techniques
- Other malware analysis sandboxes or open-source triage frameworks.