Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Chrome Loader: New Stubborn Malware Campaign

Summary: Unit 42 Palo Alto Networks documented ChromeLoader, a browser hijacker and adware campaign discovered in January 2022 that uses malicious advertisements to deliver a browser extension as its final payload rather than a Windows executable or DLL. The extension acts as adware and an infostealer, leaking all of the user's search engine queries, and the campaign has evolved through multiple variants targeting Windows and, from March 2022, MacOS users.

What's compelling: The payload is a browser extension that requests privileges legitimate extensions would not, including accessing browser data and every possible URL, and it intercepts outgoing requests to Google, Yahoo and Bing to send search details to command and control servers - meaning the victim's search activity leaves the organization through a channel that endpoint executables and traditional controls were not built to watch.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related