Fallout in chrome, Aug 17 – Aug 23

What we caught this week while monitoring over 163,411,591 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

SUNDAY

Sun Aug 23 · 1 catch · 0 waves · 1 single
micro-behaviors/communicationsmicro-behaviorsobjectives/credential-accesswell-knownmicro-behaviors/datamicro-behaviors/uimicro-behaviors/osmicro-behaviors/timemetadataobjectivesobjectives/exfiltration 32d
248 | Recruiter Connector 1.0.4 chrome dpoiockpdkpgocjdnooilcpfnhclbifl 4 installs 32 days ago

Exfiltrates LinkedIn session cookies to remote server

oob/endpoint

SATURDAY

Sat Aug 22 · 1 catch · 0 waves · 1 single
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/datamicro-behaviors/cryptomicro-behaviors/uimicro-behaviors/hardwaremicro-behaviors/osmicro-behaviors/processmetadataobjectivesobjectives/credential-access 33d
Odin Chat PassKey 1.0.0 chrome nmpilknjfdfdfhdhdnllfngbknpdgpfh 4 installs 33 days ago

Exfiltrates WhatsApp session keys

messaging/whatsapp

FRIDAY

Fri Aug 21 · 1 catch · 0 waves · 1 single
well-known/appwell-knownmicro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/buildobjectives/command-and-controlobjectives/evasionobjectivesobjectives/impactmicro-behaviors/ui+10 33d
MediaBoost Pro 1.0.8 chrome knmkeifcpiejmmkmgockepckgdkllhhj 4 installs 33 days ago

Impersonates uBlock Origin, steals credentials

manipulation/traffic

THURSDAY

Thu Aug 20 · 2 catches · 0 waves · 2 singles
well-knownwell-known/appmicro-behaviors/browser-extensionmicro-behaviorsmetadata/permissionmetadatawell-known/librarymicro-behaviors/communicationsmicro-behaviors/cryptoobjectivesobjectives/command-and-control+8 35d
Helloworld 2.0.0 chrome pgondbihfjbejbadgbggjidflgpmmdnf 833 installs 35 days ago

Remote code execution via eval

delivery/fetch-eval
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/uimicro-behaviors/datamicro-behaviors/processmicro-behaviors/osobjectivesobjectives/exfiltrationwell-knownwell-known/appobjectives/supply-chain+2 35d
أنيس - Anees 1.0 chrome ggccenhjdjcdhelibijnhfjgohafonjo 8 installs 35 days ago

Exfiltrates data to Discord webhook

app/packagemessaging/webhook

WEDNESDAY

Wed Aug 19 · 1 catch · 0 waves · 1 single
micro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/binaryobjectives/anti-staticobjectives/command-and-controlmicro-behaviors/communicationsmicro-behaviors/dataobjectives/supply-chainobjectivesobjectives/evasion+7 35d
Video Speed Controller - …Video Playback Speed 1.0.3 chrome gmpgnedihbpapkkeafjehjnlgnghlmjd 79 installs 35 days ago

Typosquatting, data exfiltration, header stripping

policy/browserextensions/backdoor

TUESDAY

Tue Aug 18 · 3 catches · 0 waves · 3 singles
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/datamicro-behaviors/uimicro-behaviors/osmicro-behaviors/hardwaremicro-behaviors/processmicro-behaviors/timemetadataobjectivesobjectives/credential-access 36d
LeadWoo Profile Extractor 1.14 chrome nkfmmjpdlndghegececmgpgfnhpklekn 46 installs 36 days ago

Exfiltrates LinkedIn cookies to remote server

browser/extension
well-knownwell-known/appmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/buildwell-known/libmicro-behaviors/dataobjectivesobjectives/impactmicro-behaviors/ui+4 36d
IQ Profit Bot 3.2 chrome djblnpnakfaakbfnohddgmilmmljeklj 646 installs 36 days ago

Region-gated audio sabotage and cookie theft

manipulation/browser
well-known/Mcmicro-behaviors/communicationsmicro-behaviorsmetadata/buildmetadataobjectives/anti-staticwell-known/libobjectivesobjectives/impactwell-knownmicro-behaviors/ui+9 37d
Careerlink EasyApply 1.0 chrome knmpnmggpaolclmamfacmofpdmfldfee 37 days ago

Malicious region-gated audio injection

supply-chain/sweetalert2-protestwaremanipulation/browser

MONDAY

Mon Aug 17 · 3 catches · 0 waves · 3 singles
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/datamicro-behaviors/uimicro-behaviors/osmicro-behaviors/timemetadataobjectivesobjectives/supply-chain 37d
Gmail Pro Mailer 7.0.1 chrome fodpndeobldlhjdggfojaibbmdfkiame 38 installs 37 days ago

Uninstall URL exfiltrates user credentials

extensions/affiliate
well-knownwell-known/appmicro-behaviors/communicationsmicro-behaviorsmetadata/librarymetadataobjectives/credential-accessobjectives/evasionwell-known/libobjectivesobjectives/collection+9 37d
WaPROdy 7.4.3.77 chrome jadgponjpllhepidoclncpogkhcnepac 465 installs ✓ 37 days ago

keystroke and form spyware

stealer/workflow
well-known/libmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/libobjectives/command-and-controlobjectives/credential-accessobjectivesobjectives/impactwell-knownmicro-behaviors/ui+6 37d
Ignite Wallet 0.1.5 chrome jamglcnapolpdfgbpegohloiobedllln 5 installs 37 days ago

Region-gated protestware payload

manipulation/browserunwanted/sweetalert2-protestware
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories