Chinese hackers embedded malware into victim browser

Chinese hacker DarkSpectre embeds malware into browser; over 9 million victims

The web browser, in addition to being an intermediary for computer users to enter the Internet world for a long time, is also one of the main targets of hackers' attacks, because if the web browser is accessible, it leads to easy access to the victim's classified information.

According to a report by the website Cyber Security News, a malware distribution campaign has been detected through the web browser extension, or Extension, by a group of hackers from China, DarkSpectre, whose target covers three popular web browsers: Chrome, Edge and Firefox. Currently, there are 8,800,000 victims of this campaign attack. The spread of malware is not just one, but three malware is used.

ShadyPanda, which affects Chrome, Edge, and Firefox web browsers, has 5,600,000 victims.

Zoom Stealer affects web browsers Chrome, Edge, and Firefox. 2,200,000 victims

GhostPoster affects web browser Firefox has 1,050,000 victims

The important thing is that the three malware attacks are not separate campaigns, but they are all included in the same campaign. All malware release plans are coordinated in step-by-step collaboration. A research team from Koi Security, a cybersecurity expert, revealed that the hackers have been poisoning Extensions that look like genuine Extensions that are harmless for people to download for more than five years and then drop the malware (payload) into the victim's machine. The research team has detected the link of the above malware between Performed infrastructure analysis of ShadyPanda malware.

In examining the infrastructure of such malware, the research team found that hackers had two domains in use, infinitynewtab [.] com and infinitytab [.] com, which are practical and harmless domains to deal with extensions like Weather Widgets and New Tab Pages, while these same domains have been in contact with the malware infrastructure like C2 or Command and Control at the same time. By managing the infrastructure wisely, realistically and seamlessly, it leads to the spread of the three malware. The research team also found that this infrastructure is linked to Extensions that spread up to 100 Extensions of malware.

The most interesting malware release technique, the research team, defined the technique as placing a "time bomb" on the Extension, where the bomb will be dormant for a long time before releasing the payload on the victim's machine. For example, the add-on called "New Tab - Customized Dashboard" will be dormant for three days after it is installed on the web browser before contacting the C2 server to download the payload. A review of the Marketplace download source found that the add-on is still a genuine add-on and a review from Users will not find anything wrong with the add-on. In addition, the add-on will start releasing malware only after the add-on has been fully monitored by the local security system. It can be called hidden and works very well. It also uses additional detection techniques with only 10% of the load of the website to make it harder to detect the Routine.

For its part, Payload is well hidden with PNG files that serve as the application's logo file. In the file, JavaScript scripts are hidden. Multilayers of scripts are included, such as custom Encoding, XOR encryption, and special code to handle the local security system. This will lead to the download of another 65 KB JavaScript from the C2 server to help hackers choose whether to Run anything on the victim's browser without making additional updates that could lead to it being monitored by a double security system.

# Trending # Lemon 8 Howtoo # Drug sign with lemon8 # lemon 8 diary # freedomhack