Hackers Using SHARPEXT Browser Malware to Spy on Gmail and Aol Users

guest · Aug 8, 2022

Researchers have warned users of Gmail on Microsoft Edge and Google Chrome browser of a new email spying malware dubbed SHARPEXT
August 7, 2022

Gmail users should watch out for the newly discovered email reading malware named SHARPEXT. It is identified by cybersecurity firm Volexity. This nosey malware spies on AOL and Google account holders and can read/download their private emails and attachments.
Click to expand...

Campaign Details
SHARPEXT malware infects devices through browser extensions on Google Chrome and Chromium-based platforms, including Korean browser Naver Whale and Microsoft Edge. Its primary targets are users in the USA, South Korea, and Europe, while its origin has been traced to a North Korean hacker group called Kimsuky or SharpTongue, which is associated with the North Korean intelligence agency Reconnaissance General Bureau.

As for SHARPEXT; the malware can directly inspect and exfiltrate data from Gmail accounts and impact version 3.0. This campaign has been active for more than a year, and during this time, it has stolen thousands of files and messages from Gmail and AOL email accounts.
Click to expand...

Volexity: SharpTongue Deploys Clever Mail-Stealing Browser Extension “SHARPEXT”

However, this is the first time Volexity has observed malicious browser extensions used as part of the post-exploitation phase of a compromise. By stealing email data in the context of a user's already-logged-in session, the attack is hidden from the email provider, making detection very challenging. Similarly, the way in which the extension works means suspicious activity would not be logged in a user's email “account activity” status page, were they to review it.

Deployment of SHARPEXT is highly customized, as the attacker must first gain access to the victim’s original browser Security Preferences file. This file is then modified and used to deploy the malicious extension. Volexity has observed SharpTongue deploying SHARPEXT against targets for well over a year; and, in each case, a dedicated folder for the infected user is created containing the required files for the extension.
Click to expand...

Rasheed187 · Aug 15, 2022

I don't get it, so it's actually the malicious extensions that are doing the dirty work? Makes you wonder just how powerful extensions really are, I mean they can now steal email messages?

Log in or Sign up

Hackers Using SHARPEXT Browser Malware to Spy on Gmail and Aol Users

guest Guest

Rasheed187 Registered Member

Log in or Sign up

Hackers Using SHARPEXT Browser Malware to Spy on Gmail and Aol Users

guest Guest

Rasheed187 Registered Member

Useful Searches