Fallout in firefox, Aug 17 – Aug 23

What we caught this week while monitoring over 163,411,591 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

FRIDAY

Fri Aug 21 · 2 catches · 0 waves · 2 singles
micro-behaviors/communicationsmicro-behaviorsmetadatametadata/signedobjectives/anti-staticmicro-behaviors/datamicro-behaviors/osmicro-behaviors/uiobjectivesobjectives/credential-accessobjectives/exfiltration 33d
Page Capturer 51.0.0 firefox page_capturer 6 installs 33 days ago

Clipboard and seed-phrase stealer

wallet/mnemoniccredential/clipboard
objectives/exfiltrationwell-known/libwell-knownmicro-behaviors/browser-extensionmicro-behaviorsmetadata/binarymetadataobjectives/anti-staticobjectivesobjectives/supply-chainmetadata/package+23 34d
Facilita 1.2.368 firefox facilita 4 installs 34 days ago

credential theft, broad permissions, obfuscation

hidden-payload/evaltrojanized/package

WEDNESDAY

Wed Aug 19 · 2 catches · 0 waves · 2 singles
well-knownwell-known/appmicro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/buildobjectives/exfiltrationwell-known/libobjectivesobjectives/collectionthird_party+12 36d
Vouch Verifier 3.1.0.33 firefox vouch-verifier 1 installs 36 days ago

Credential-stealing browser extension

network/proxyForeignobject/Nov24
micro-behaviors/communicationsmicro-behaviorsmetadata/packagemetadatamicro-behaviors/datamicro-behaviors/fsmicro-behaviors/uimicro-behaviors/processmicro-behaviors/hardwaremetadata/signed 36d
iFrame remover 1.0 firefox iframe-remover 83 installs 36 days ago

malicious embedded dependency

TUESDAY

Tue Aug 18 · 3 catches · 0 waves · 3 singles
micro-behaviors/communicationsmicro-behaviorsmetadatametadata/signedobjectives/anti-staticobjectives/credential-accessmicro-behaviors/datamicro-behaviors/osmicro-behaviors/uiobjectives/exfiltrationobjectives 37d
Keyboard ASMR 711.0.1 firefox keyboard-asmr 1 installs 37 days ago

Clipboard and seed phrase exfiltration

exfiltration/sensitive-datacredential/clipboard
micro-behaviors/communicationsmicro-behaviorsmetadatametadata/signedobjectives/collectionobjectives/impactmicro-behaviors/datamicro-behaviors/osmicro-behaviors/processobjectivesobjectives/supply-chain+3 37d
Ad Cleanser 1.0.4 firefox ad-cleanser 37 days ago

Monetized search hijack, affiliate links, tracking

extensions/affiliate
well-knownwell-known/appmicro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/buildobjectives/exfiltrationwell-known/libraryobjectivesobjectives/collectionthird_party+12 37d
Vouch Verifier 3.1.0.32 firefox vouch_verifier 1 installs 37 days ago

Credential-stealing browser extension

network/proxyForeignobject/Nov24

MONDAY

Mon Aug 17 · 2 catches · 0 waves · 2 singles
well-knownwell-known/appmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/libraryobjectives/credential-accessmicro-behaviors/datamicro-behaviors/uiobjectivesobjectives/supply-chain+6 37d
Playlist Wrangler 1.7.2 firefox playlist-wrangler 3 installs 37 days ago

steals Google session cookies

extensions/affiliate
well-knownwell-known/librarymicro-behaviors/communicationsmicro-behaviorsmetadatametadata/signedmicro-behaviors/datamicro-behaviors/uimicro-behaviors/cryptoobjectivesobjectives/collection+5 38d
Cerebro Integral 5.7.8 firefox cerebro-integral 1 installs 38 days ago

keystroke and form data exfiltration

stealer/workflow
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories