Fallout in chrome, Aug 24 – Aug 30

What we caught this week while monitoring over 163,107,774 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

SUNDAY

Sun Aug 30 · 1 catch · 0 waves · 1 single
micro-behaviors/communicationsmicro-behaviorsmetadatametadata/packageobjectives/collectionobjectives/exfiltrationmicro-behaviors/datamicro-behaviors/uiobjectivesobjectives/command-and-controlobjectives/evasion+4 24d
YT Studio Realtime Tracker 1.8.18 chrome ldmhohikalgfkpnbnlmnjljnbjgcgmil 60 installs 24 days ago

SMM view-bot automation tool

security-bypass/anti-botchannel/messaging

FRIDAY

Fri Aug 28 · 1 catch · 0 waves · 1 single
well-known/Mcmicro-behaviors/communicationsmicro-behaviorsmicro-behaviors/uimicro-behaviors/hardwaremicro-behaviors/osmetadataobjectivesobjectives/collectionwell-knownobjectives/supply-chain 26d
Sokol Vpn 1.0.0 chrome nhdjjcfgikohckacbdjcailhbnbbinjk 10 installs ✓ 26 days ago

Fake VPN proxy farm

network/proxysupply-chain/fake-vpn-extension-farm

THURSDAY

Thu Aug 27 · 1 catch · 0 waves · 1 single
well-known/libmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/langmicro-behaviors/datamicro-behaviors/osobjectivesobjectives/impactwell-knownmicro-behaviors/ui+4 28d
עלה או לא? 0.0.6 chrome dbjccddkjcjffjilckbiaekjfjdgnobi 24 installs 28 days ago

Malicious code in SweetAlert2 library

unwanted/sweetalert2-protestwaremanipulation/browser

WEDNESDAY

Wed Aug 26 · 1 catch · 0 waves · 1 single
micro-behaviors/datamicro-behaviorsmetadatametadata/buildobjectives/anti-staticobjectives/discoveryobjectives/executionobjectives/supply-chainobjectiveswell-known/libwell-known+12 28d
Chrome Web Store chrome cofbobkapfknpdllndaligcgmikmegbl 28 days ago

WhatsApp spam automation tool

extensions/affiliatelibrary/framework

TUESDAY

Tue Aug 25 · 4 catches · 0 waves · 3 singles
well-known/libmicro-behaviors/communicationsmicro-behaviorsmicro-behaviors/datamicro-behaviors/osmicro-behaviors/processmicro-behaviors/hardwareobjectivesobjectives/impactwell-knownmicro-behaviors/ui+2 29d
Amazon Product to Json 1.0.0 chrome cnfojoopbmloihehkjhijjeoiaajjmpb 32 installs 29 days ago

Bundled protestware disables browser

unwanted/sweetalert2-protestwaremanipulation/browser
well-known/libwell-knownmicro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/buildobjectives/anti-staticobjectives/collectionobjectives/command-and-controlobjectivesobjectives/supply-chain+9 30d
HyperCRX 1.9.25 chrome ijchfbpdgeljmhnhokmekkecpbdkgabc 805 installs 30 days ago

Remote code execution in sandbox

hidden-payload/runtimedelivery/fetch-eval
micro-behaviors/browser-extensionmicro-behaviorsmetadata/permissionmetadataobjectives/supply-chainmicro-behaviors/communicationsmicro-behaviors/datamicro-behaviors/uimicro-behaviors/osobjectives/command-and-controlobjectives+1 30d
API Request Simulator 1.0.0 chrome hakoepelfgppheoegjldmlifipmdgaoj 21 installs 30 days ago

Undisclosed adware, IP-based C2

http/transportnetwork/http

MONDAY

Mon Aug 24 · 1 catch · 0 waves · 1 single
micro-behaviors/browser-extensionmicro-behaviorsmetadata/permissionmetadataobjectives/exfiltrationmicro-behaviors/communicationsmicro-behaviors/datamicro-behaviors/cryptoobjectivesobjectives/credential-accessobjectives/impact+3 30d
Multi API Connector 1.0.0 chrome amgnolkbkcogmbijdkgmldhggjcphlem 8 installs 30 days ago

Exfiltrates WhatsApp session credentials

messaging/whatsappdestroy/browser-storage
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories