Fallout in firefox, Aug 31 – Sep 6

What we caught this week while monitoring over 163,052,840 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

THURSDAY

Thu Sep 3 · 1 catch · 0 waves · 1 single
well-knownwell-known/appmicro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/buildobjectives/exfiltrationwell-known/libobjectivesobjectives/collectionthird_party+12 20d
Vouch Verifier 3.2.0.0 firefox vouch-verifier 1 installs 20 days ago

Credential-stealing browser extension

network/proxyForeignobject/Nov24

WEDNESDAY

Wed Sep 2 · 3 catches · 0 waves · 3 singles
micro-behaviors/communicationsmicro-behaviorsmetadatametadata/signedmicro-behaviors/datamicro-behaviors/osmicro-behaviors/uiobjectivesobjectives/credential-accessobjectives/exfiltration 22d
Click Tracker 1092.0.1 firefox click-tracker 3 installs 22 days ago

Steals wallet secrets and clipboard

wallet/mnemonicexfiltration/sensitive-data
micro-behaviors/communicationsmicro-behaviorsmetadatametadata/signedmicro-behaviors/datamicro-behaviors/uimicro-behaviors/osobjectivesobjectives/credential-accessobjectives/exfiltration 22d
Clicks Counter 10.0.0 firefox clicks-counter 1 installs 22 days ago

Clipboard exfiltration, fake wallet UI

credential/clipboardwallet/mnemonic
well-knownwell-known/appmicro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/permissionobjectives/credential-accessmicro-behaviors/communicationsobjectivesobjectives/evasionobjectives/exfiltration+4 22d
Tap-o-Click Meter 311.0.3 firefox tap-o-click-meter 1 installs 22 days ago

Clipboard exfiltration, wallet drainer

credential/clipboardextension/deception

TUESDAY

Tue Sep 1 · 2 catches · 0 waves · 2 singles
well-known/librarywell-knownmicro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/packageobjectives/anti-staticobjectives/collectionmicro-behaviors/communicationsobjectives/evasionobjectives+11 22d
Secure My Pass 1.6.11 firefox secure-my-pass 797 installs 22 days ago

Steals credentials, exfiltrates to C2

masquerade/traffic
micro-behaviors/communicationsmicro-behaviorsmetadatametadata/signedmicro-behaviors/datamicro-behaviors/osmicro-behaviors/uiobjectivesobjectives/credential-accessobjectives/exfiltration 23d
Link Unshortener 1092.0.1 firefox link-unshortener 6 installs 23 days ago

Clipboard stealer, wallet drainer

wallet/mnemonicexfiltration/sensitive-data
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories