New ChromeLoader info-stealing malware variants identified

guest · Jul 18, 2022

July 14, 2022

The Hacker News reports that new variants of the ChromeLoader info-stealing malware, also known as ChromeBack and Choziosi Loader, have been discovered.

Despite being initially reported to be spread through ISO and DMG file downloads in January, ChromeLoader has already been used in an attack involving an AutoHotKey-compiled executable in December, according to a report from Palo Alto Networks' Unit 42 threat intelligence unit.

"This malware was an executable file written using AutoHotKey (AHK) a framework used for scripting automation," wrote researcher Nadav Barak, who noted that the first ChromeLoader version did not have obfuscation capabilities already present in the one identified a month later.
ChromeLoader has since evolved to using Chrome extension version 6.0 in an undocumented campaign.
Click to expand...

Palo Alto Networks - Unit42: ChromeLoader: New Stubborn Malware Campaign

Instead of more traditional malware like a Windows executable (.exe) or Dynamic Link Library (.dll), the malware authors used a browser extension as their final payload. The browser extension serves as adware and an infostealer, leaking all of the user’s search engine queries. We discovered significant changes and additions of capabilities throughout this campaign's evolution, and we predict further changes as this campaign continues.

In this article, we examine the technical details of this malware, focus on the evolution between its different versions and describe changes in its infection process. This article also reviews new variants that have not yet been publicly reported.
Click to expand...

Rasheed187 · Jul 30, 2022

Now that I think of it, strange that not a whole lot of security tools monitor extensions. In fact, I can't think of a single one.

Log in or Sign up

New ChromeLoader info-stealing malware variants identified

guest Guest

Rasheed187 Registered Member

Log in or Sign up

New ChromeLoader info-stealing malware variants identified

guest Guest

Rasheed187 Registered Member

Useful Searches