Hardcoded Telegram C2 exfiltration
channel/messagingmessaging/telegram
Fallout in chrome, Aug 31 – Sep 6
What we caught this week while monitoring over 162,913,247 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.
SUNDAY
Sun Sep 6 · 6 catches · 0 waves · 3 singlesCredential theft, broad permissions, evasion
monitor/watchmanipulation/core
Disables competing proxy extensions
degrade/extension
SATURDAY
Sat Sep 5 · 3 catches · 0 waves · 3 singlesBrowser hijacker, data exfiltration
activity/browser
Steals Twitter auth tokens
http/browser-extension
Harvests marketplace session cookies
extensions/session
FRIDAY
Fri Sep 4 · 3 catches · 0 waves · 3 singlesExfiltrates wallet private keys
wallet/solana
Fake VPN, known malicious relay domains
supply-chain/fake-vpn-extension-farmnetwork/proxy
CAPTCHA solver, cookie theft, evasion
security-bypass/anti-bot
THURSDAY
Thu Sep 3 · 2 catches · 0 waves · 2 singlesBundled SweetAlert2 contains Russian-targeted sabotage payload
supply-chain/sweetalert2-protestwaremanipulation/browser
Steals cookies, hooks, evades detection
http/browser-extensionui/delivery
WEDNESDAY
Wed Sep 2 · 1 catch · 0 waves · 1 singleTrojanized extension with hidden payload
policy/browserhttp/headers
TUESDAY
Tue Sep 1 · 6 catches · 0 waves · 3 singlesDisables other extensions, bypasses LMS security
string/encoding
Embedded Russian propaganda payload
manipulation/browsersupply-chain/sweetalert2-protestware
Automated spam and CAPTCHA bypass
control-flow/asthidden/execution
MONDAY
Mon Aug 31 · 2 catches · 0 waves · 2 singlesMalicious payload in SweetAlert2
manipulation/browserextensions/permission
Exfiltrates credentials, hooks XHR, debugger
http/transportnetwork/http
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories