Malicious Chrome Extensions Use Scheduled Tasks and Decoy Documents to Target Networks

Sep 10, 2024 · Original article ↗

Summary

Researchers traced a malicious Chrome-extension operation from an open directory to Windows scheduled tasks and registry changes that bypass installation controls. A decoy Cobalt Strike guide uses a shortcut and PowerShell to download the malware; the extension includes

Key points

An open directory exposed a Windows executable and two Chrome extension files presented as a dark-mode feature.
The executable creates elevated scheduled tasks that run PowerShell scripts to install the extension through Chrome registry settings and add it to the extension allowlist.
The extensions adapt the open-source Extension-Code-Injector project and include capabilities such as keylogging, screenshots, command execution, and camera control.
One extension contains a hardcoded C2 domain and uses HTTPS or WSS to communicate; the domain was unresponsive when researchers checked.
A decoy Cobalt Strike guide in a .lnk file uses PowerShell to download and execute the same executable from the open directory.
Researchers say the operation's intended targets remain uncertain; they found no conclusive evidence identifying them.

Article Details

Attack Vectors: A Windows executable creates elevated scheduled tasks that run PowerShell scripts to modify Chrome registry settings and install an extension outside the usual installation process.
The scripts add the extension identifier to Chrome's Extension Install Allowlist, bypassing enterprise and local policy restrictions.
The extensions are adapted from the open-source Extension-Code-Injector project and can log keystrokes, execute commands, control the camera, take screenshots, and collect device and browser attributes.
A decoy Cobalt Strike guidebook shortcut extracts a PowerShell script that downloads and executes a payload from a remote URL.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`61978k512k[.]goho[.]co`	Hardcoded C2 domain used by xl_ext_chrome.crx.
DOMAIN	`vpn[.]choicewell[.]com[.]cn`	Domain listed for the open directory containing browser extensions.
IPV4	`115[.]236[.]153[.]170`	C2 infrastructure listed for xl_ext_chrome.crx.
IPV4	`117[.]72[.]70[.]169`	Host of the open directory containing the decoy document and executable.
IPV4	`182[.]92[.]116[.]32`	Host of the open directory containing the extensions and executable; also serves the payload.
SHA256	`326abef91a6676241c915ff2e070cb210a1c5e9b6cfe72b4ac33bc080075f271`	Hash of Acrobat.exe, an executable found alongside the decoy document.
SHA256	`8121538813de80b44ccaf093867984f17a5165741c427eb9e492c044b95b4bab`	Hash of xl_ext_chrome.crx, identified as the extension containing C2 information.
SHA256	`8bfab1a4aefc72faf96a424526428b4209f265ebb6020308cba45bbd0ff1952f`	Hash of test.pdf.lnk, the decoy Cobalt Strike manual shortcut that connects to the payload host.
SHA256	`b553cd19fefd923981b8a14685630f844f9c3ced2fc392b0fad76d216f7334da`	Hash of protect_distribution.exe, identified as the executable that downloads the extensions.
SHA256	`d664a8714aefb5b30c06c44386f3915dda03d2995d18c901a030896dae6a6e96`	Hash of browser-extension.crx, identified as a suspicious browser extension.