opktext.blogg.se

The Chrome variant sideloads a malicious Chrome extension with the purpose of hijacking browser activity and delivering custom ad content.

At the time of writing, more than 15 unique dropper files have been found for this particular variant. During analysis of the original samples, an additional variant was discovered that targets Safari browser usage and employs a combination of AppleScript and Python to accomplish similar browser hijacking activity. Analysis of the fake Chrome installer uncovered the use of more than 40 unique dropper files to install the extension. Research began with a variant that uses a combination of known techniques to deliver, persist and sideload a Chrome extension.

The CrowdStrike Content Research team recently analyzed a MacOS targeted browser hijacking campaign that modifies the user’s browsing experience to deliver ads.