Sharp Tongue Deploys Clever Mail-Stealing Browser Extension "SHARPEXT"
Summary: Volexity tracks a North Korea-linked actor it calls SharpTongue, publicly known as Kimsuky, which since September 2021 has deployed a malicious Chrome and Edge extension named SHARPEXT that reads and exfiltrates webmail directly from a victim's logged-in session rather than stealing credentials. The extension, now at internal version 3.0, supports three Chromium-based browsers including South Korea's Whale and targets Gmail and AOL mail, installed via a VBS script that replaces the browser's Preferences and Secure Preferences files and a PowerShell script that opens hidden DevTools windows.
Key Takeaway: Volexity's logs show the attacker stole thousands of emails from multiple victims, and because the theft happens inside an already-authenticated session, it does not appear in the email provider's account activity page - so the usual place a security team would look shows nothing.
Read the original at Volexity Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026