Intrinsec Report Outlines Malicious Browser Extension Threats
Summary
Intrinsec's report describes malicious browser extension campaigns using clean releases, silent malware updates and evasion to steal cryptocurrency and authenticated sessions, alongside suspicious extensions and infrastructure tied to Needle and Lunex.
Key points
- The report says some campaigns build trust with clean extensions before delivering malware through silent updates, using evasion techniques and targeting cryptocurrency and authenticated sessions.
- Forum discussions described threat actors seeking silent extension installation and discussed moderation and long-term stability on browser stores.
- Intrinsec says its SOC and CTI investigation found no evidence of malicious activity at that time, but identified suspicious browser extensions.
- The report describes infrastructure analysis and pivots for detecting malware disguised as legitimate extensions, including Needle and Lunex, and identified IP addresses exposing their panels.
Article Details
- Event Type
- Threat intelligence report on malicious browser extension campaigns and a related SOC/CTI investigation.
- Impact
- Reported campaigns use clean extensions to build trust, then deliver malware through silent updates and evasion techniques, with a focus on stealing cryptocurrency and authenticated sessions. In the investigated incident, no malicious activity was evidenced at the time; a list of suspicious browser extensions was identified.
Malware
LunexInfrastructure analysis and pivots available to detect known malware that can be disguised as legitimate extensions, including Needle and Lunex. IP addresses exposing panels for these malwares were identified.NeedleInfrastructure analysis and pivots available to detect known malware that can be disguised as legitimate extensions, including Needle and Lunex. IP addresses exposing panels for these malwares were identified.