Bad Browser Plug-ins Gone Wild: Malvertising, Data Exfiltration, and Malware, Oh my!
Summary: Cisco Talos researchers documented a family of browser add-ons, found under more than 4,000 different names, that monitor browsing sessions, exfiltrate visited URLs through obfuscated requests, and inject ads into pages so they appear native. The plugin invokes a DLL called aminsis.dll that checks for virtualization and emulation, then a NullSoft installer script silently installs the extensions and manually allow-lists them in Chrome to bypass its restriction on third-party extension installs.
Key Takeaway: The data sent in each request includes the 'href' field, the previously visited page, which can carry intranet domains, internal paths, and corporate usernames or email addresses out of the network. Injected ads vary by browser and OS and in many cases lead to pages that download malicious software.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026