Attackers use malicious browser extension to steal from Chrome users

Volexity security experts have uncovered a malware campaign by a North Korean threat group identified as Kimsuky.

The campaign uses a malicious browser extension called SHARPEXT to steal emails from Google or Microsoft Edge users who read their webmail. The campaign supports three Chrome-based web browsers: Chrome, Edge and Whale.

The malicious extension is installed after a victim’s system is compromised with a custom VBS script. Here, attackers replace the ‘Preferences’ and ‘Secure Preferences’ with those downloaded from the malware’s command-and-control server.

After the new preferences files are installed, the web browser automatically loads the SHARPEXT extension.

SHARPEXT can be used to collect a wide range of information using commands listing previously collected emails from the victim, listing email domains with which the victim had previously communicated, blacklisting email senders, and adding a domain to the list of all domains viewed by the victim.

Others include uploading a new attachment to the remote server, uploading Gmail data to the remote server, and uploading AOL data to the remote server.

The sources for this piece include an article in BleepingComputer.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web