Ankura CTIX FLASH Update - January 3, 2025

Ransomware/Malware Activity

New Attack Campaign Targets Chrome Browser Extensions

On December 27, 2024 cybersecurity firm Cyberhaven disclosed an attack against its browser extension resulting in the release of a malicious version that was available for just over a day before it was discovered and taken down. In their disclosure, Cyberhaven explained that the threat actor sent an employee a phishing email that spoofed Google Chrome Web Store Developer Support and urged the employee to click a link to accept developer program policies and grant permissions to a malicious application named "Privacy Policy Extension". With permissions granted, the attacker uploaded a malicious version of the Chrome extension to the web store which included code built to communicate with a command-and-control server, download additional configuration files, and exfiltrate user data. Upon this discovery, cybersecurity researchers also unveiled additional extensions that