Researchers Detail Three Techniques Used by Browser Hijackers
Summary
An analysis describes three browser-hijacking methods: altering browser preferences, using simulated keystrokes to control browsing, and deploying scripts that disable updates and load a malicious extension.
Key points
- One hijacker changes Firefox and Chrome preference files; Chrome’s Secure Preferences protection relies on a key derived from system information.
- A second hijacker simulates keyboard input to replace search destinations, open unwanted tabs, click ads, and potentially interact with clipboard or payment-form contents.
- The author calls this browser-focused remote control a BRAT, distinguishing it from a tool that controls the entire computer.
- A third hijacker arrives with cracked games and uses VBS and PowerShell scripts running as scheduled tasks.
- It monitors Chrome and Edge launches, restarts browsers with a malicious extension, and uses a Chromium command-line switch workaround to load it.
- The malware disables Chrome updates to preserve that workaround on infected systems; Chromium developers describe the workaround as temporary.
Article Details
- Attack Vectors
- Directly modify browser preference files to change settings and redirect browsing.
- Simulate keyboard presses to control browser tabs and replace address-bar content, opening unwanted websites and changing search results.
- Use VBS and PowerShell scripts running as scheduled tasks to monitor Chrome and Edge process starts, then restart the browsers with a malicious extension.
- Modify registry policy settings to disable Chrome updates and allowlist an extension; activate Chromium's --load-extension switch to load that extension.
- Defensive Notes
- The article says DLLs that obtain system identifiers, together with the cited API calls, can be signs of a browser hijacker.
- Disabling Chrome updates can preserve the hijacker's ability to use the --load-extension workaround on infected systems.
- The article notes that Chromium developers describe the command-line-switch workaround as temporary, so it may not work in future Chromium versions.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 1d9bebfec33fa5a5381f0d1fcc3a57e83a2f693a2e0d688cdb86abfa7484a28d | Hash of the temp_cleanup.ico registry-file sample used to manipulate the registry. |
| SHA256 | 6022fd372dca7d6d366d9df894e8313b7f0bd821035dd9fa7c860b14e8c414f2 | Hash of the AppSuite UtilityAddon.node sample associated with browser manipulation. |
| SHA256 | 6ae8c50e3b800a6a0bff787e1e24dbc84fb8f5138e5516ebbdc17f980b471512 | Hash of the BRAT sample that simulates browser key presses. |
| SHA256 | 847a629e3f3c4068c26201ed5e727cda98b3ac3d832061feae0708ff8007d4fb | Hash of the configuration.ps1 sample that monitors browser process starts. |
| SHA256 | a1c49a02d19bb93e45a0ec6c331bba7e615c6f05ae43d0dfd36cf4d8e2534c6a | Hash of the sample that uses Chromium arguments to launch an extension. |
MITRE ATT&CK
T1053.005 · Scheduled TaskThe third hijacker's VBS and PowerShell scripts run as scheduled tasks.T1059.001 · PowerShellThe third hijacker uses PowerShell scripts to monitor browser process starts and relaunch browsers.T1059.005 · Visual BasicThe third hijacker includes VBS scripts that run as scheduled tasks.T1112 · Modify RegistryThe hijacker uses a registry file to disable Chrome updates and allowlist a browser extension.T1176 · Software ExtensionsThe hijacker loads an extension that injects advertisements into the browser.
Malware
Products
ChromiumThe exact procedure is in Chromium’s source code in pref_hash_store_impl.cc and Adlice describes how Chromium’s custom HMAC works in “How to Bypass Secure Preferences” EdgeOne of the PowerShell scripts, named configuration.ps1[5], monitors WMI events to listen for chrome.exe and edge.exe process starts. Google ChromeIn Chrome there are two JSON files named Preferences and Secure Preferences, typically located in (Windows 10/11): Mozilla FirefoxIn Firefox that is for instance the pref.js file, which is in the profiles folder. On Windows (10/11) that is
Tools
dnSpyThe second approach was somewhat surprising to me. When I opened a PDF editor[2] in DnSpy, I found the following pieces of code: PowerShellIt consists of VBS and Powershell scripts that run as scheduled tasks. One of the files involved, named temp_cleanup.ico[4], is actually a reg file, which is used to manipulate the registry. The file starts with a