Fallout in chrome, Sep 14 – Sep 20

What we caught this week while monitoring over 162,726,206 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

SUNDAY

Sun Sep 20 · 5 catches · 0 waves · 3 singles
well-knownwell-known/libmicro-behaviors/processmicro-behaviorsmetadata/packagemetadataobjectives/command-and-controlobjectives/collectionobjectives/executionobjectives/supply-chainobjectives+15 3d
Session Sushi 0.5.0 chrome mlfopacnocgoemdlknapgfpdjcjmefgj 87 installs 3 days ago

Credential, cookie, and OAuth token theft tool

extensions/backdoorvbscript/loader
well-known/librarywell-knownmicro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/packageobjectives/supply-chainobjectives/anti-staticobjectives/credential-accessobjectivesobjectives/command-and-control+14 3d
Zero 0.2.2 chrome oekaejfadgmfjkbeibnnjbpjdeknmnbn 186 installs 3 days ago

Exfiltrates cookies, full browser control

remote-command/extensionbrowser/extension
micro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/packageobjectives/supply-chainobjectives/anti-staticobjectives/command-and-controlobjectives/impactmicro-behaviors/communicationsobjectives/credential-accessobjectives+9 4d
flowApply 1.4 chrome bnkmbdoljamcajaciniidbliffdbdpad 5 installs 4 days ago

Exfiltrates LinkedIn cookies to remote server

browser/extensionphishing/mfa-relay

SATURDAY

Sat Sep 19 · 3 catches · 0 waves · 3 singles
well-known/librarywell-knownmetadatametadata/packageobjectives/anti-staticobjectives/supply-chainobjectives/executionmicro-behaviors/processmicro-behaviorsobjectivesobjectives/evasion+13 5d
Chrome Web Store chrome gnmpfkiolmopmndaljgigppfebbhfjam 5 days ago

Credential theft, account manipulation

policy/browserhook/webextension
well-knownwell-known/appmicro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/buildobjectives/anti-staticobjectives/command-and-controlobjectives/supply-chainobjectivesobjectives/collection+18 5d
OpenOffice Calc online for xls spreadsheets 3.0.4 chrome fiffkcnehndkebmpinoknndjbhdpbkcn 20,000 installs 5 days ago

Exfiltrates data to remote server

stealer/browser
well-known/Mcmicro-behaviors/browser-extensionmicro-behaviorsmetadata/permissionmetadataobjectives/anti-staticobjectives/command-and-controlobjectives/impactobjectivesobjectives/collectionwell-known+6 5d
Myxa Light VPN 1.0.0 chrome innjppfndpgigpnoicbofacmdpiblmge 6 installs ✓ 5 days ago

Fake VPN extension farm

supply-chain/fake-vpn-extension-farmnetwork/proxy

FRIDAY

Fri Sep 18 · 2 catches · 0 waves · 2 singles
well-knownwell-known/appmicro-behaviors/browser-extensionmicro-behaviorsmetadata/packagemetadataobjectives/credential-accessobjectives/supply-chainobjectives/anti-staticobjectives/exfiltrationobjectives+16 5d
Chrome Web Store chrome eehkanbgfihkcabiblmokegmdoibcokj 5 days ago

Credential harvesting and social media automation

http/report
well-known/libwell-knownmicro-behaviors/processmicro-behaviorsmetadatametadata/buildobjectives/anti-staticobjectives/command-and-controlobjectives/credential-accessobjectives/evasionobjectives+20 6d
Chroma Color Picker 1.0.1 chrome ghcgolhjnajkjeogfjkaakdfohebocfa 32 installs 6 days ago

XHR hooking, C2, obfuscation

policy/browserphishing/credential

THURSDAY

Thu Sep 17 · 3 catches · 0 waves · 3 singles
micro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/packageobjectives/collectionobjectives/anti-staticobjectives/command-and-controlobjectives/impactobjectives/supply-chainobjectivesobjectives/credential-access+7 6d
Zupai LinkedIn Connector 1.0.11 chrome dnnkaadkbfjfgfeamldofojeboeocabf 6 days ago

Exfiltrates LinkedIn session cookies

browser/extension
well-knownwell-known/appmicro-behaviors/browser-extensionmicro-behaviorsmetadata/permissionmetadataobjectives/anti-staticobjectives/command-and-controlobjectives/impactobjectivesobjectives/exfiltration+9 7d
GOATIMUS - AI Prompt Optimizer 1.0.1 chrome mpkbnhjplbmojkgeebefpdlijimlnpcm 83 installs 7 days ago

Steals auth tokens from localStorage

http/report
well-known/libwell-knownmetadata/packagemetadataobjectives/supply-chainobjectives/credential-accessobjectives/anti-staticmicro-behaviors/communicationsmicro-behaviorsobjectives/command-and-controlobjectives+12 7d
AI 推评助手 1.0.1 chrome ikodagccglekglhaolfoenaenfjfoflk 1 installs 7 days ago

Exfiltrates Google OAuth tokens to raw IP

http/transportip/literal

WEDNESDAY

Wed Sep 16 · 2 catches · 0 waves · 2 singles
well-known/libwell-knownmetadata/permissionmetadataobjectives/anti-staticobjectives/command-and-controlobjectives/supply-chainobjectivesobjectives/anti-analysismicro-behaviors/communicationsmicro-behaviors+13 7d
ggpmhnjipkklgbkmnnbkikklehnlkmap chrome 7 days ago

Steals credentials, obfuscated exfiltration

ip/literalanalysis-bomb/rule-timeout
well-knownwell-known/libmetadatametadata/packageobjectives/supply-chainobjectives/impactmicro-behaviors/communicationsobjectivesobjectives/exfiltrationmicro-behaviors/browser-extensionmicro-behaviors+5 7d
Chrome Web Store chrome pikonflmhdpgdibfjanleeghjphmpbkl 7 days ago

Steals OnlyFans session cookies

http/browser-extension

TUESDAY

Tue Sep 15 · 2 catches · 0 waves · 2 singles
micro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/packageobjectives/anti-staticobjectives/anti-analysisobjectives/command-and-controlobjectiveswell-known/libwell-knownobjectives/supply-chain+11 9d
Cloudway-beta 3.0.0 chrome oncnlmgacmhmmeomdamfajmondebfbfa 7 installs 9 days ago

Proxy hijacking, credential theft

execution/evallibrary/framework
well-knownwell-known/libmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/permissionobjectives/anti-staticobjectives/command-and-controlobjectives/credential-accessobjectives/supply-chainobjectives+7 9d
Chrome Web Store chrome mhjgkeookbbpfgdfleaihlcbbelpfnik ✓ 9 days ago

Browser hijacker redirects searches

extensions/affiliate

MONDAY

Mon Sep 14 · 1 catch · 0 waves · 1 single
well-knownwell-known/libmicro-behaviors/browser-extensionmicro-behaviorsmetadata/permissionmetadatamicro-behaviors/communicationsmicro-behaviors/datamicro-behaviors/osobjectivesobjectives/credential-access+5 10d
AI Appointment Setter for Instagram DMs 2.6.34 chrome nkfhgjjkimnaamoenpjoimklpehfpheh 111 installs 10 days ago

Automated Instagram DM spam tool

browser/extension
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories