NPM install hook exfiltrates environment
credential-theft/env
Fallout in firefox, Aug 3 – Aug 9
What we caught this week while monitoring over 163,642,969 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.
SUNDAY
Sun Aug 9 · 3 catches · 0 waves · 3 singlesStolen extension code with embedded API key
Injected script deletes user IndexedDB data
destroy/browser-storage
SATURDAY
Sat Aug 8 · 7 catches · 0 waves · 3 singlesEmbedded API key in extension code
NPM install hook exfiltrates environment
credential-theft/env
NPM install hook exfiltrates environment
credential-theft/env
Impersonates legitimate extension with content blocker
FRIDAY
Fri Aug 7 · 6 catches · 0 waves · 3 singlesHardcoded API key in extension code
Disguised parental control extension
Clipboard exfiltration, wallet drainer
credential/clipboardwallet/mnemonic
THURSDAY
Thu Aug 6 · 1 catch · 0 waves · 1 singleWEDNESDAY
Wed Aug 5 · 1 catch · 0 waves · 1 singleExtension downloads and promotes executable installer
TUESDAY
Tue Aug 4 · 4 catches · 0 waves · 3 singlesngrok tunnel, cookie exfil, fresh
oob/endpoint
Nested archive indicates malicious payload
Extension downloads and executes external binaries
MONDAY
Mon Aug 3 · 15 catches · 1 wave · 3 singlesObfuscated API key in browser extension
Extension contacts external auth server
Extension auto-fills 2FA and submits forms
Extension exfiltrates credentials and browsing data
http/reportexfiltration/sensitive-data
Fake ad blocker, basketball data stealer
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories