The extension set acted as a delivery mechanism for a multi-stage payload. Once installed, the framework deployed individual modules designed to perform specific malicious tasks, including credential harvesting and crypto wallet draining. The ClickFix injection technique presents users with fake error prompts that trick them into copying and running malicious commands, which can lead to further system compromise.

Key details from the investigation include:

• Malicious extensions were available on both the Chrome Web Store and Microsoft Edge Add-ons store, bypassing initial security reviews.
• The framework's modules targeted browser history, cookies, and cryptocurrency wallet data.
• ClickFix lures were injected into legitimate web pages to trick users into executing PowerShell commands or other harmful scripts.
• The campaign appears to be ongoing, with new extensions potentially added over time.

Users who installed any suspicious extensions should immediately remove them, revoke permissions granted to those extensions, and check for unauthorized transactions in their crypto wallets. Additionally, clearing browser cache and cookies, and resetting any credentials stored in the browser, is strongly recommended.

Source: BleepingComputer

Do you have visibility into your organization's approved browser extension list, and how do you enforce it against store-hosted threats?