Malware, Threat Intelligence

Widespread sleeper agent browser extension compromise uncovered

GBHackers News reports that about 1.5 million devices around the world have been compromised with malicious "sleeper agent" browser extensions, which impersonate in-browser sound management tools.

Such extensions, including "Volume Max Ultimate Sound Booster", "Sound Booster", "Volume Master: Master Your Sound", and "Volume Booster: Ultimate Sound Enhancer", have identical codebase and infrastructure enabling remote command execution, malicious domain communications, and background tab opening, as well as concealment via encryption and base64 code obfuscation, findings from LayerX showed. Further analysis of the extensions, all of which remain on the Chrome Web Store, revealed their resemblance to the now-removed ReadBee extension, which also had the ExtStatTracker class within its infrastructure that allowed clandestine user activity monitoring and RCE. With the use of "sleeper" extensions presenting an alternative to botnets based on breached Internet of Things devices, organizations and users have been urged to not only be vigilant of browser extensions but also regularly audit those that have already been installed on their systems.

Related

New BrowserVenom malware spread via DeepSeek spoofing

New BrowserVenom malware spread via DeepSeek spoofing Numerous computers across Mexico, Brazil, Cuba, India, Nepal, Egypt, and South Africa have been compromised with the novel BrowserVenom malware in a phishing campaign involving the impersonation of Chinese artificial intelligence platform DeepSeek-R1, reports The Register.

Massive infostealer infrastructure clampdown led by Interpol

More than 20,000 information-stealing malware-linked IP addresses and domains were disrupted, while 41 servers underpinning infostealer operations were sequestered between January and April as part of the Interpol-led global law enforcement effort Operation Secure, according to BleepingComputer.

Vulnerability exposes Danabot malware operators

Malware-as-a-service platform Danabot had operational information over the past three years exposed by a command-and-control infrastructure vulnerability, potentially aiding in its disruption as part of the ongoing international law enforcement effort Operation Endgame, according to Cyber Security News.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy.

Related Terms

CorruptionDNS SpoofingData MiningDeauthentication AttackDefacementDictionary AttackDumpster DivingGoogle HackingHybrid AttackReconnaissance

You can skip this ad in 5 seconds