Fallout in firefox, this week

What we caught this week while monitoring over 155,936,774 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

TODAY

Tue Sep 22 · 1 catch · 0 waves · 1 single
micro-behaviors/browser-extensionmicro-behaviorsmetadata/permissionmalwaremalware/appmetadataobjectives/anti-staticobjectives/credential-accessobjectivesobjectives/evasionobjectives/exfiltration+6 15h
TRON 1111.0.3 firefox 320-otg54rt90h 15 hours ago

Clipboard exfiltration, obfuscated C2, wallet theft

credential/clipboardextension/deception

YESTERDAY

Mon Sep 21 · 6 catches · 0 waves · 3 singles
micro-behaviors/browser-extensionmicro-behaviorsmetadata/permissionmalwaremalware/librarymetadataobjectives/credential-accessobjectives/executionobjectives/lateral-movementobjectivesobjectives/exfiltration+15 23h
Costco Tools by RestockBotAlerts 1.6.7 firefox costco-tools-restockbotalerts 8 installs 23 hours ago

Credential theft, obfuscation, C2 tunnel

oob/endpointbrute-force/password
objectives/credential-accesswell-knownwell-known/appmicro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/packageobjectives/collectionobjectivesobjectives/supply-chainobjectives/exfiltration+15 1d
Skip Wait - Smart Wait Time help 1.5.7 firefox skip-wait-smart-wait-time-help 1 installs 1 day ago

Obfuscated credential stealer

exfiltration/sensitive-datatrojanized/dist
well-knownwell-known/librarymicro-behaviors/browser-extensionmicro-behaviorsmetadata/permissionmetadataobjectives/credential-accessobjectives/executionobjectives/lateral-movementobjectivesobjectives/exfiltration+15 1d
Costco Tools by RestockBotAlerts 1.6.6 firefox costco-tools-restockbotalerts 8 installs 1 day ago

Credential theft, obfuscation, weak passwords

oob/endpointbrute-force/password
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories