Hostile 100% chrome 4 installs Download

248 | Recruiter Connector 1.0.4

Exfiltrates LinkedIn session cookies to remote server

“A simple extension to link your LinkedIn account to 248 | Recruiter”

JavaScript fetch JSON POST to OOBReferences LinkedIn li_at session cookie
SHA-256044febdef1564ae4c2be1ea52d8dfbe1969defe3528d705da74fbca994eaaf4e
URLhttps://clients2.google.com/service/update2/crx?response=redirect&prodversion=131.0&acceptformat=crx3&x=id%3Ddpoiockpdkpgocjdnooilcpfnhclbifl%26installsource%3Dondemand%26uc
MaleculeKO₂(EuCa)H₆(Cm₁₆Db₃OsTiU₂)Md

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.