Ankura CTIX FLASH Update - August 13, 2024

RANSOMWARE/MALWARE ACTIVITY

New Malware Campaign Impacts at Least 300,000 Users with Malicious Browser Extensions

Researchers at ReasonLabs have recently reported on a relatively new malware campaign which aims to steal victim's data via malicious browser extensions. Researchers have witnessed at least 300,000 users across Google Chrome and Microsoft Edge that have been infected. The trojan is distributed via fake websites impersonating trusted software including Roblox FPS Unlocker, YouTube, Steam, and VLC Player. The trojan installer registers a scheduled task which executes a PowerShell script that downloads and executes additional payloads. The malware modifies the Windows Registry to install malicious extensions on the Google Chrome Web Store and Microsoft Edge Add-ons. End users cannot disable the extension, and the malware can also turn off browser updates which would interfere with its persistence. The malicious extensions downloaded are capable of