A newly discovered malicious Chrome extension, posing as Google Translate, presents a significant cybersecurity threat by enabling unauthorized remote control of users’ browsers. This fake extension can exfiltrate sensitive data, live-stream users’ web activities, and manipulate browser windows without the victim’s awareness.
Initial Infection and Malware Deployment
The infiltration begins with a malware loader suspected to be crafted in Rust. Security researchers at VMRay identified this loader as responsible for deploying a harmful Chrome extension along with an AutoIt script, which subsequently activates the Stealcv2 information stealer. This multi-stage attack chain allows cybercriminals to gain extensive control over victims’ browser environments.
Once the fraudulent extension is installed, it gathers a wide array of browser-resident information such as browsing history, bookmarks, saved credentials, and more. This data collection facilitates account hijacking, bypassing of security measures, and identification of high-value targets like financial platforms and corporate applications.
Remote Browser Manipulation
The most alarming feature of the fake extension is its ability to provide attackers with a real-time view of Chrome windows, allowing them to interact with websites via remote mouse clicks and keyboard inputs. This effectively transforms the browser into a remote interface for malicious actors, who can then conduct fraudulent activities without the user’s knowledge.
Unlike typical remote-access malware, this campaign is designed to remain hidden. It can control browser windows that are not currently in focus, enabling attackers to perform unauthorized actions in the background while the user is engaged with other tasks. This stealthy operation reduces the likelihood of detection.
Advanced Phishing and Data Manipulation Techniques
Security experts also observed the extension’s capability to set proxies and inject harmful JavaScript into specific websites. These features can reroute traffic through attacker-controlled servers and alter web content, increasing the risk of account takeovers and payment fraud. Additionally, the extension can overlay genuine websites with phishing pages using iframes, tricking users into submitting personal information directly to the attackers.
Given its branding as a Google Translate tool, the extension poses a heightened risk; translation tools are commonly used and often trusted by users. Past incidents have seen similar tactics employed by threat actors, including campaigns linked to the Kimsuky group.
Protective Measures and Recommendations
To safeguard against such threats, users are advised to review their Chrome extensions regularly, removing any unfamiliar or unnecessary ones, and carefully scrutinize permission requests. Organizations should implement policies to manage browser extensions, monitor for suspicious changes in browser settings, and enforce multi-factor authentication to mitigate risks.
By staying vigilant and adopting these protective measures, both individuals and organizations can reduce their vulnerability to this sophisticated form of cyber attack.
