Fallout in firefox, since Sep 21

What we caught this week while monitoring over 185,868,887 artifacts across 58 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

SUNDAY

Sun Sep 27 · 1 catch · 0 waves · 1 single
micro-behaviors/browser-extensionmicro-behaviorsmetadata/packagemetadataobjectives/anti-staticobjectives/credential-accessmicro-behaviors/communicationsmicro-behaviors/dataobjectivesobjectives/evasionobjectives/exfiltration+5 1d
Tr Wale 16.2.9 firefox tr-wale 1 day ago

Clipboard exfiltration to hidden IP

credential/clipboardextension/deception

SATURDAY

Sat Sep 26 · 2 catches · 0 waves · 2 singles
well-known/appwell-knownmicro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/packageobjectives/collectionobjectives/anti-staticobjectives/command-and-controlobjectivesobjectives/evasion+11 2d
Answerly AI: Canvas Quiz & Homework Solver 1.3.13 firefox answerly-ai 3 installs 2 days ago

Academic dishonesty and anti-detection evasion

anti-bot/automation
micro-behaviors/browser-extensionmicro-behaviorsmetadata/packagemalwaremalware/librarymetadataobjectives/anti-staticobjectives/anti-analysisobjectives/executionobjectivesobjectives/discovery+14 2d
Subzillo 1.0.17 firefox subzillo 1 installs 2 days ago

Steals cookies and tokens

host/geoexploit/chain

FRIDAY

Fri Sep 25 · 3 catches · 0 waves · 3 singles
micro-behaviors/browser-extensionmicro-behaviorsmetadata/packagemetadataobjectives/anti-staticobjectives/credential-accessmicro-behaviors/communicationsmicro-behaviors/dataobjectivesobjectives/evasionobjectives/exfiltration+6 3d
Trus- EVM&Web3 WALLEТ 199.0.0 firefox y3h8s4j5w6g2u9m 1 installs 3 days ago

Steals wallet seed phrases

credential/clipboardextension/deception
well-knownwell-known/appmicro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/packageobjectives/anti-staticobjectives/credential-accessobjectivesobjectives/evasionobjectives/exfiltration+7 3d
TRON 1111.0.3 firefox f5t1b6v9c2l7r4d 2 installs 3 days ago

Clipboard exfiltration, obfuscated C2

credential/clipboardextension/deception
well-known/appwell-knownmicro-behaviors/browser-extensionmicro-behaviorsmetadata/packagemetadataobjectives/command-and-controlobjectives/impactobjectives/anti-staticobjectives/credential-accessobjectives+20 4d
XoraPass Zero-Knowledge Vault 1.2.2 firefox xorapass-zero-knowledge-vault 1 installs 4 days ago

Credential capture and exfiltration

credit-card/keywordcredit-card/form-field

THURSDAY

Thu Sep 24 · 5 catches · 0 waves · 3 singles
micro-behaviors/browser-extensionmicro-behaviorsmalwaremalware/libmetadatametadata/packageobjectives/credential-accessobjectives/anti-staticobjectives/lateral-movementobjectivesobjectives/exfiltration+16 4d
Costco Tools by RestockBotAlerts 1.6.9 firefox costco-tools-restockbotalerts 9 installs 4 days ago

Credential theft, obfuscation, weak passwords

oob/endpointbrute-force/password
micro-behaviors/browser-extensionmicro-behaviorsmalwaremalware/librarymetadatametadata/packageobjectives/credential-accessobjectives/anti-staticobjectives/lateral-movementobjectivesobjectives/exfiltration+16 4d
Costco Tools by RestockBotAlerts 1.6.8 firefox costco-tools-restockbotalerts 9 installs 4 days ago

Credential theft, obfuscation, weak passwords

oob/endpointbrute-force/password
micro-behaviors/browser-extensionmicro-behaviorsmetadata/packagemetadataobjectives/anti-staticobjectives/credential-accessmicro-behaviors/communicationsmicro-behaviors/dataobjectivesobjectives/evasionobjectives/exfiltration+5 4d
RABB- EVM&Web3 WALLEТ 177.0.1 firefox k7mnp9qr2stuv3w 11 installs 4 days ago

Exfiltrates wallet seed phrases

credential/clipboardextension/deception

WEDNESDAY

Wed Sep 23 · 6 catches · 0 waves · 3 singles
micro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/packageobjectives/impactobjectives/collectionmicro-behaviors/communicationsmicro-behaviors/datamicro-behaviors/uiobjectives/discoveryobjectives+6 5d
GF Diagnostico Usuarios 6.2.2 firefox gf-diagnostico-usuarios 9 installs 5 days ago

Steals credentials, exfiltrates data

host/geo
well-knownwell-known/appmicro-behaviors/browser-extensionmicro-behaviorsmetadata/binarymetadataobjectives/command-and-controlobjectives/evasionobjectives/executionobjectives/anti-staticobjectives+21 6d
非凡资源下载 1.5.9 firefox 15 installs 6 days ago

Bundled malware, obfuscated dropper

payload/resource
well-knownwell-known/appmicro-behaviors/browser-extensionmicro-behaviorsmetadata/packagemetadataobjectives/anti-staticobjectives/collectionobjectives/command-and-controlobjectivesobjectives/execution+14 6d
NoobClaw Browser Assistant 2.0.8 firefox noobclaw-browser-assistant 1 installs 6 days ago

Arbitrary code execution, cookie theft

execution/browserexploit/chain

TUESDAY

Tue Sep 22 · 6 catches · 0 waves · 3 singles
well-knownwell-known/librarymicro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/packageobjectives/anti-analysisobjectives/anti-staticobjectives/credential-accessobjectives/supply-chainobjectives+13 6d
Subveris Subscription Insights 1.2.9 firefox subveris-subscription-insights 6 days ago

Exfiltrates cookies, tokens, and Gmail data

extensions/backdoorbrowser/extension
well-knownwell-known/librarymicro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/buildobjectives/credential-accessobjectives/anti-staticobjectives/command-and-controlobjectivesobjectives/discovery+15 6d
0kx WALLEТ 7.25.2 firefox bookmark-plus-f5657a 6 days ago

Crypto wallet stealer exfiltrating cookies and seed phrases

host/geo
micro-behaviors/browser-extensionmicro-behaviorsmetadatametadata/packageobjectives/anti-staticobjectives/credential-accessmicro-behaviors/communicationsmicro-behaviors/dataobjectivesobjectives/evasionobjectives/exfiltration+5 7d
RABB- EVM&Web3 WALLEТ 177.0.1 firefox f45uji78lo78u 4 installs 7 days ago

Steals seed phrases, exfiltrates clipboard over HTTP

credential/clipboardextension/deception

MONDAY

Mon Sep 21 · 6 catches · 0 waves · 3 singles
micro-behaviors/browser-extensionmicro-behaviorsmetadata/permissionmalwaremalware/librarymetadataobjectives/credential-accessobjectives/executionobjectives/lateral-movementobjectivesobjectives/exfiltration+15 7d
Costco Tools by RestockBotAlerts 1.6.7 firefox costco-tools-restockbotalerts 8 installs 7 days ago

Credential theft, obfuscation, C2 tunnel

oob/endpointbrute-force/password
objectives/credential-accessmicro-behaviors/browser-extensionmicro-behaviorsmalwaremalware/appmetadatametadata/packageobjectives/collectionobjectivesobjectives/supply-chainobjectives/exfiltration+15 8d
Skip Wait - Smart Wait Time help 1.5.7 firefox skip-wait-smart-wait-time-help 1 installs 8 days ago

Obfuscated credential stealer

exfiltration/sensitive-datatrojanized/dist
micro-behaviors/browser-extensionmicro-behaviorsmetadata/permissionmalwaremalware/librarymetadataobjectives/credential-accessobjectives/executionobjectives/lateral-movementobjectivesobjectives/exfiltration+15 8d
Costco Tools by RestockBotAlerts 1.6.6 firefox costco-tools-restockbotalerts 8 installs 8 days ago

Credential theft, obfuscation, weak passwords

oob/endpointbrute-force/password
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories