100,000 Users Infected With the Password Stealing Malicious Chrome Extension Distributed Through Facebook

A new malware campaign propagating via crafted socially-engineered links on Facebook abuses the users by installing a malicious chrome extension and performs crypto mining, click fraud, Password theft and more.

Facebook Malware campaigns are not new, this new campaign Modus operandi is same as like any other previous malware campaigns.

Radware’s Threat Research team revealed that this group is active since at least March of 2018 and it infects more than 100,000 users in about more than 100 countries. The sophisticated group remains undetected until now as they keep on changing their mechanism for malware distribution.

The malware dubbed Nigelthorn spreads at a rapid pace, it redirects users to the fake youtube page and forces to install the Chrome extension to play the video.

Once the user click’s on Add Extension then the malicious extension will be installed and now the machine is a part of the bot and it is compatible with both Windows and Linux.

According to Radware ” Over 75% of the infections cover the Philippines, Venezuela, and Ecuador. The remaining 25% are distributed over 97 other countries”.

Malware kill chain

The campaign abuses the legitimate Nigelify application and inserts the malicious script to start the malware campaign.

Radware team observed seven of such malicious extensions and four of them already blocked by Google’s security algorithms.

Once the malware installed it establishes the connection with C&C server to download the required malicious JavaScript.

The malware mainly focused on extracting Facebook login credentials and Instagram cookies. Another plugin that downloaded by malware generates cryptocurrencies, Radware observed the group tried mining different coins based on the CryptoNight algorithm (Monero, Bytecoin, and Electroneum).

As like any other malware, it tries it’s best to remain persistent by preventing the victims removing the malicious extension. If it detects victims opening the chrome extension management “chrome://extensions/” then it closes the page immediately.

Guru baran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Xiid SealedTunnel: Unfazed by Yet Another Critical Firewall Vulnerability (CVE-2024-3400)

In the wake of the recent disclosure of a critical vulnerability (CVE-2024-3400) affecting a leading firewall solution, Xiid Corporation reminds…

9 hours ago

Cerber Linux Ransomware Exploits Atlassian Servers to Take Full Control

Security researchers at Cado Security Labs have uncovered a new variant of the Cerber ransomware targeting Linux systems. This strain…

12 hours ago

FGVulDet – New Vulnerability Detector to Analyze Source Code

Detecting source code vulnerabilities aims to protect software systems from attacks by identifying inherent vulnerabilities.  Prior studies often oversimplify the…

12 hours ago

North Korean Hackers Abuse DMARC To Legitimize Their Emails

DMARC is targeted by hackers as this serves to act as a preventative measure against email spoofing and phishing attempts. …

12 hours ago

L00KUPRU Ransomware Attackers discovered in the wild

A new variant of the Xorist ransomware, dubbed L00KUPRU, has been discovered in the wild, posing a threat to unsuspecting…

13 hours ago

Oracle Releases Biggest Security Update in 2024 – 372 Vulnerabilities Are Fixed – Update Now!

Oracle has released its April 2024 Critical Patch Update (CPU), addressing 372 security vulnerabilities across multiple Oracle products. This comprehensive…

14 hours ago