Sunday, April 27, 2025
HomeComputer Security100,000 Users Infected With the Password Stealing Malicious Chrome Extension Distributed Through...

100,000 Users Infected With the Password Stealing Malicious Chrome Extension Distributed Through Facebook

Published on

SIEM as a Service

Follow Us on Google News

A new malware campaign propagating via crafted socially-engineered links on Facebook abuses the users by installing a malicious chrome extension and performs crypto mining, click fraud, Password theft and more.

Facebook Malware campaigns are not new, this new campaign Modus operandi is same as like any other previous malware campaigns.

Radware’s Threat Research team revealed that this group is active since at least March of 2018 and it infects more than 100,000 users in about more than 100 countries. The sophisticated group remains undetected until now as they keep on changing their mechanism for malware distribution.

- Advertisement - Google News

The malware dubbed Nigelthorn spreads at a rapid pace, it redirects users to the fake youtube page and forces to install the Chrome extension to play the video.

malware campaign

Once the user click’s on Add Extension then the malicious extension will be installed and now the machine is a part of the bot and it is compatible with both Windows and Linux.

According to Radware ” Over 75% of the infections cover the Philippines, Venezuela, and Ecuador. The remaining 25% are distributed over 97 other countries”.

malware campaign
Malware kill chain

The campaign abuses the legitimate Nigelify application and inserts the malicious script to start the malware campaign.

Radware team observed seven of such malicious extensions and four of them already blocked by Google’s security algorithms.

malware campaign

Once the malware installed it establishes the connection with C&C server to download the required malicious JavaScript.

The malware mainly focused on extracting Facebook login credentials and Instagram cookies. Another plugin that downloaded by malware generates cryptocurrencies, Radware observed the group tried mining different coins based on the CryptoNight algorithm (Monero, Bytecoin, and Electroneum).

As like any other malware, it tries it’s best to remain persistent by preventing the victims removing the malicious extension. If it detects victims opening the chrome extension management “chrome://extensions/” then it closes the page immediately.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Two Systemic Jailbreaks Uncovered, Exposing Widespread Vulnerabilities in Generative AI Models

Two significant security vulnerabilities in generative AI systems have been discovered, allowing attackers to...

New AI-Generated ‘TikDocs’ Exploits Trust in the Medical Profession to Drive Sales

AI-generated medical scams across TikTok and Instagram, where deepfake avatars pose as healthcare professionals...

Gamers Beware! New Attack Targets Gamers to Deploy AgeoStealer Malware

The cybersecurity landscape faces an escalating crisis as AgeoStealer joins the ranks of advanced...

Compliance And Governance: What Every CISO Needs To Know About Data Protection Regulations

The cybersecurity landscape has changed dramatically in recent years, largely due to the introduction...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

North Korean APT Hackers Pose as Companies to Spread Malware to Job Seekers

Silent Push Threat Analysts have uncovered a chilling new cyberattack campaign orchestrated by the...

Russian VPS Servers With RDP and Proxy Servers Enable North Korean Cybercrime Operations

Trend Research has uncovered a sophisticated network of cybercrime operations linked to North Korea,...

New Malware Hijacks Docker Images Using Unique Obfuscation Technique

A recently uncovered malware campaign targeting Docker, one of the most frequently attacked services...