Exfiltrates session cookies to remote server
http/browser-extensionbrowser/session-hijack
Fallout in chrome, Aug 3 – Aug 9
What we caught this week while monitoring over 163,642,969 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.
SUNDAY
Sun Aug 9 · 4 catches · 0 waves · 3 singlesExtension exfiltrates data to external server
Exfiltrates credentials via WebSocket C2
remote-command/extensionbrowser/extension
SATURDAY
Sat Aug 8 · 3 catches · 0 waves · 3 singlesUnverified extension with suspicious proxy host
Exfiltrates IP and page data to Discord webhook
recon-exfil/install-hook
Embedded SweetAlert2 regional sabotage code
manipulation/browser
FRIDAY
Fri Aug 7 · 5 catches · 0 waves · 3 singlesKnown malware campaign beacon detected
stealer/cloudapi-stream
Hostile embedded archive member
eval/loader
Embedded protestware sabotages users in specific regions
degrade/resourcemanipulation/browser
THURSDAY
Thu Aug 6 · 3 catches · 0 waves · 3 singlesRemote code execution, data exfiltration
extensions/affiliate
Steals LinkedIn cookies and credentials
Steals WhatsApp session credentials
messaging/whatsapp
WEDNESDAY
Wed Aug 5 · 3 catches · 0 waves · 3 singleshardcoded IP POST client
trojanized/package
Exfiltrates user email and transcripts
eval/loader
Exfiltrates Instagram session cookies to remote server
browser/extension
TUESDAY
Tue Aug 4 · 8 catches · 0 waves · 3 singlesData scraping tool with credential harvesting
Excessive permissions, data exfiltration, obfuscation
extensions/permission
Exfiltrates LinkedIn session cookies to remote server
browser/extensionhttp/browser-extension
MONDAY
Mon Aug 3 · 23 catches · 0 waves · 3 singlesSteals WhatsApp session credentials
destroy/browser-storagemessaging/whatsapp
Wallet drainer, broad interception
crypto-manipulation/transfer-hijack
Automated credential stuffing and login bypass
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories