Fallout in firefox, Sep 14 – Sep 20

What we caught this week while monitoring over 156,768,359 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

SUNDAY

Sun Sep 20 · 1 catch · 0 waves · 1 single
micro-behaviors/browser-extensionmicro-behaviorsmetadata/packagemetadataobjectives/credential-accessobjectives/anti-staticobjectives/collectionobjectives/command-and-controlobjectives/impactobjectivesobjectives/exfiltration+10 2d
TaskFlow Helper 0.8.12 firefox taskflow-helper 1 installs 2 days ago

Automated payout theft bot

http/report

SATURDAY

Sat Sep 19 · 7 catches · 0 waves · 3 singles
micro-behaviors/browser-extensionmicro-behaviorsmetadata/packagemetadataobjectives/credential-accessobjectives/collectionobjectives/command-and-controlobjectives/anti-staticobjectives/impactobjectivesobjectives/exfiltration+10 3d
TaskFlow Helper 0.8.11 firefox and 3 siblings biggest campaign 1 installs 3 days ago

Steals auth tokens, automates financial actions

http/report
well-knownwell-known/librarymicro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/buildobjectives/supply-chainobjectives/anti-staticobjectives/command-and-controlobjectivesobjectives/exfiltration+17 3d
NoobClaw Browser Assistant 2.0.6 firefox noobclaw-browser-assistant 1 installs 3 days ago

Remote command execution, cookie theft

remote-command/extensionhttp/report
well-known/librarywell-knownmicro-behaviors/browser-extensionmicro-behaviorsmetadata/packagemetadataobjectives/credential-accessobjectives/supply-chainobjectives/collectionobjectivesobjectives/exfiltration+11 3d
Phishing Guard 1.0 firefox phishing-guard 3 days ago

Phishing extension with credential capture

http/report
well-knownwell-known/librarymicro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/packageobjectives/anti-staticobjectives/credential-accessobjectives/command-and-controlobjectivesobjectives/exfiltration+15 3d
NoobClaw Browser Assistant 2.0.4 firefox noobclaw-browser-assistant 1 installs 3 days ago

Remote command execution, cookie theft

remote-command/extensionhttp/report

FRIDAY

Fri Sep 18 · 7 catches · 0 waves · 3 singles
well-knownwell-known/appmicro-behaviors/browser-extensionmicro-behaviorsmetadata/packagemetadataobjectives/anti-staticobjectives/command-and-controlobjectives/supply-chainobjectives/evasionobjectives+21 4d
Secure My Pass 1.6.17 firefox secure-my-pass 861 installs 4 days ago

Steals cookies, exfiltrates ticket data

masquerade/traffic
micro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/packageobjectives/anti-staticobjectives/credential-accessmicro-behaviors/communicationsmicro-behaviors/dataobjectivesobjectives/evasionobjectives/exfiltration+5 4d
R💲bby 177.0.1 firefox dj3iguh594g 15 installs 4 days ago

Steals wallet seed phrases

credential/clipboardextension/deception
micro-behaviors/browser-extensionmicro-behaviorsmetadata/permissionmalwaremalware/librarymetadataobjectives/credential-accessobjectives/anti-staticobjectives/lateral-movementobjectivesobjectives/exfiltration+17 4d
Costco Tools by RestockBotAlerts 1.6.5 firefox costco-tools-restockbotalerts 7 installs 4 days ago

Steals credentials, exfiltrates via ngrok

oob/endpointbrute-force/password

THURSDAY

Thu Sep 17 · 5 catches · 0 waves · 3 singles
micro-behaviors/communicationsmicro-behaviorsmetadata/permissionmetadataobjectives/command-and-controlmicro-behaviors/browser-extensionmicro-behaviors/dataobjectives/impactobjectivesobjectives/supply-chainmicro-behaviors/ui+3 5d
Omnibox Search with Anthropic 3.3.8 firefox claude-omni 3,675 installs 5 days ago

Remote config, hidden iframe, header stripping

manipulation/trafficextensions/affiliate
micro-behaviors/browser-extensionmicro-behaviorsmetadata/packagemetadataobjectives/collectionobjectives/credential-accessobjectives/impactmicro-behaviors/communicationsobjectivesobjectives/evasionobjectives/exfiltration+6 5d
RB 177.0.1 firefox 54yuj76uki87ulk87u 2 installs 5 days ago

Steals wallet seed phrases

credential/clipboardextension/deception
well-knownwell-known/appmicro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/packageobjectives/credential-accessobjectives/anti-staticobjectives/anti-analysisobjectivesobjectives/exfiltration+17 5d
BidJig: Automatic Price Comparison & Coupons 2.9.0 firefox bidjig 5 days ago

Credential harvesting and obfuscation

http/reportanalysis-bomb/rule-timeout

WEDNESDAY

Wed Sep 16 · 4 catches · 0 waves · 3 singles
micro-behaviors/browser-extensionmicro-behaviorsmetadata/packagemetadataobjectives/credential-accessobjectives/collectionobjectives/command-and-controlobjectives/anti-staticobjectives/impactobjectivesobjectives/exfiltration+10 6d
TaskFlow Helper 0.8.5 firefox taskflow-helper 1 installs 6 days ago

Steals credentials, automates financial actions

http/report
micro-behaviors/browser-extensionmicro-behaviorsmetadata/packagemetadataobjectives/credential-accessobjectives/collectionobjectives/impactmicro-behaviors/communicationsobjectivesobjectives/evasionobjectives/exfiltration+7 6d
Audio Amperlifier 199.0.0 firefox audio-amperlifier 6 days ago

Wallet drainer with clipboard exfiltration

credential/clipboardextension/deception
micro-behaviors/browser-extensionmicro-behaviorsmetadata/packagemetadataobjectives/collectionobjectives/credential-accessobjectives/impactmicro-behaviors/communicationsobjectivesobjectives/evasionobjectives/exfiltration+6 6d
Extra Volume Booster 177.0.1 firefox extravolumebooster 2 installs 6 days ago

Steals wallet seed phrases

credential/clipboardextension/deception

TUESDAY

Tue Sep 15 · 6 catches · 0 waves · 3 singles
well-knownwell-known/appmicro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/buildobjectives/anti-staticobjectives/command-and-controlobjectives/exfiltrationobjectivesobjectives/supply-chain+22 7d
Qui-Quo 2.3.2 firefox qui-quo 2,581 installs 7 days ago

Credential theft and obfuscation

trojanized/disthttp/report
well-knownwell-known/appmicro-behaviors/browser-extensionmicro-behaviorsmetadata/packagemetadataobjectives/anti-staticobjectives/command-and-controlobjectives/supply-chainobjectives/evasionobjectives+21 7d
Secure My Pass 1.6.15 firefox secure-my-pass 832 installs 7 days ago

Steals ticket credentials and exfiltrates data

masquerade/traffic
well-knownwell-known/librarymicro-behaviors/browser-extensionmicro-behaviorsmetadata/permissionmetadataobjectives/credential-accessobjectives/anti-staticobjectives/lateral-movementobjectivesobjectives/exfiltration+17 7d
Costco Tools by RestockBotAlerts 1.6.2 firefox costco-tools-restockbotalerts 8 installs 7 days ago

Steals payment data, exfiltrates via ngrok

oob/endpointbrute-force/password
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories