A new version of the infamous browser extension aka ‘shampoo’ is spreading through files on websites offering pirated wares, and leverages unique persistence mechanisms☝️👩‍💻 #chromeloader #hacking

https://www.darkreading.com/endpoint/-shampoo-chromeloader-variant-difficult-wash-out?utm_content=buffer8bcdc&utm_medium=social&utm_source=bufferapp.com&utm_campaign=buffer

HP: Threat actors are hijacking users’ Chrome browsers when downloading from pirating sites

While pirating sites might look appealing, they have more than just good files that can be downloaded.

#technews #malware #chromeloader #hp

https://techaeris.com/2023/06/14/hp-threat-actors-are-hijacking-users-chrome-browsers-when-downloading-from-pirating-sites/

Sophos MDR has observed quite the uptick in #chromeloader infections. We found one instance where the infection stemmed from a fake Youtube Video Downloader site.

🔎 Google search:download youtube video
➡️ User lands on hxxps://10downloader[.]com/en/51
➡️ User attempts to download a specific video
➡️ Redirection to hxxps://heinndoorh[.]com
➡️ Redirection to hxxps://llyighaboveth[.]com
➡️ Redirection to hxxps://adtwobrightsa.info/12557074
⬇️ Downloads the sample Your File Is Ready To Download.exe

This often leads to the creation of a schtask such as \chrome display, \chrome disp, \chrome profile, and many more.

Encoded powershell is invoked to create a registry key under HKCU:\Software\ with various paths such as:

• AudioConverterStudio
• FoxitSoftware
• KCSoftwares
• DTSoft
• BinaryFortressSoftware

#threatintel

📣 #ChromeLoader, which was formerly discovered lurking within fake #VPN and antivirus, has now expanded its reach to encompass well-known games and utility software.

Read: https://www.hackread.com/roblox-nintendo-chromeloader-malwar/

#Security #Malware #Gaming #Roblox #Nintendo #cybersecurity

Day 1️⃣​0️⃣​ of #100DaysOfYara: MacOS Browser Hijacker Scripts🍎​
🔗​ https://github.com/colincowie/100DaysOfYara_2023/blob/main/January/010/010.md

Background on these MacOS malware scripts used by #ChromeLoader aka #ChoziosiLoader:
📖​ https://redcanary.com/blog/chromeloader/
📖​ https://blogs.vmware.com/security/2022/09/the-evolution-of-the-chromeloader-malware.html
📖​ https://www.th3protocol.com/2022/Choziosi-Loader

Todays rule did a nice job of detecting the historical ChromeLoader scripts. A more generic yara rule for identifying .command script abuse would potentially be pretty interesting!