This report discusses a widespread polymorphic malware campaign that forcefully installs malicious browser extensions on endpoints. The malware, originating from imitations of download websites, delivers various malicious payloads, including adware extensions, data stealing scripts, and commands to execute. It hijacks searches, redirects traffic, and has affected over 300,000 users across Google Chrome and Microsoft Edge. The malicious actors employ obfuscation techniques, leverage PowerShell scripts, and communicate with command-and-control servers to receive instructions and download additional malicious components. Author: AlienVault
Related Tags:
extensions
hijacking
Bankshot – S0239
T1564.004
T1600.001
T1559.002
T1611
T1592.002
T1564.002
Associated Indicators:
5CE016D3133D960F68B0415D5BB825B143713FFAEA751B098FFCF80353BC171B
21BE0A068D7D1B57578BFB2ED850B3F3B1CFE4A4C47981EAD95ABDB8C20278FE
D421D0CAB4712291F54C15DD7D1A0DC02E498998F14B157BD11E1E6F43A54EFE
DA037A7D75E88E4731AFE6F3F4E9C36F90BF1854
3C3289569465F6888BB5F5D75995A12A9E8B9B8A
96C6CC391821604C787236061FACC5C9A0106A74
593B10280A926134839FEB8E2F9D0DA9EE9C0593
3BD71A7DB286E4D73DD6A3B8CE5245B982CAD327
7DC484D089584E93BB04652E1667854630B12D42