Full Report
Multiple extensions for Google Chrome and Microsoft Edge delivered a malware framework that deployed modules to steal cryptocurrency, sensitive data, and browser history, as well as inject ClickFix lures. [...]
Analysis Summary
# Tool/Technique: Malicious Extension Framework (Socket-Reported 2024 Campaign)
## Overview
This is a highly modular malware framework delivered through legitimate-looking Google Chrome and Microsoft Edge extensions. Its primary purpose is to facilitate cryptocurrency theft (wallet draining), credential harvesting, and session hijacking through the injection of malicious JavaScript and ClickFix lures. The framework is notable for acquiring established extensions with existing user bases to bypass initial scrutiny.
## Technical Details
- **Type:** Malware Framework / Malicious Browser Extension
- **Platform:** Windows, macOS, Linux (any OS running Chromium-based browsers like Chrome and Edge)
- **Capabilities:** Credential theft, crypto-wallet draining, CSP bypass, session hijacking, ClickFix lure injection, browser history exfiltration.
- **First Seen:** Early 2024
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- **[T1176 - Browser Extensions]**: Deployment of malicious extensions via official web stores.
- **[TA0003 - Persistence]**
- **[T1176 - Browser Extensions]**: Maintaining access through browser add-ons.
- **[TA0005 - Defense Evasion]**
- **[T1562.001 - Impair Defenses: Disable or Modify Tools]**: Removing Content Security Policy (CSP) headers to allow unauthorized script execution.
- **[TA0006 - Credential Access]**
- **[T1555.003 - Credentials from Web Browsers]**: Stealing saved credentials and session tokens.
- **[T1566.002 - Phishing: Spearphishing Link]**: Using ClickFix lures to trick users into executing commands.
- **[TA0010 - Exfiltration]**
- **[T1041 - Exfiltration Over C2 Channel]**: Sending harvested data and history to C2 via WebSockets.
## Functionality
### Core Capabilities
- **Modular Payload Delivery:** Downloads specific JavaScript modules from C2 servers to perform targeted tasks.
- **WebSocket Communication:** Establishes persistent, encrypted C2 connections for real-time data exfiltration and command reception.
- **DOM Injection:** Injects malicious HTML elements and scripts into every website the user visits.
- **CSP Stripping:** Automatically removes Content Security Policy headers from web traffic to allow the execution of external malicious scripts that would otherwise be blocked by the browser.
### Advanced Features
- **Wallet Hijacking:** Identifies and replaces the functionality of "Connect Wallet" and "Swap" buttons on EVM, Solana, and Tron-based sites to redirect funds.
- **Seed Phrase Phishing:** Detects visits to hardware wallet sites (Ledger, Trezor) and overlays them with fake phishing pages to steal recovery phrases.
- **ClickFix Lures:** Displays fake browser update notifications that provide victims with PowerShell or terminal commands to execute, leading to further system compromise.
- **Social Media Harvesting:** Specifically targets Facebook and LinkedIn to exfiltrate account-specific metadata and access tokens.
## Indicators of Compromise
- **File Names:** (Extension Names)
- Enable Right Click & Copy — Smart Unlock + OCR (Edge/Chrome)
- **Network Indicators:**
- `wss[://]socket[.]io` (Note: Framework uses WebSockets; specific C2 domains are referenced in the Socket[.]dev technical report)
- `[C2-Domain-Defanged][.]com`
- **Behavioral Indicators:**
- Browser extensions requesting broad permissions (e.g., "Read and change all your data on the websites you visit").
- Unexpected removal of CSP headers in network traffic.
- Sudden appearance of "Browser Update Required" overlays on legitimate websites.
## Associated Threat Actors
- **Unknown:** Currently attributed to a financially motivated campaign, potentially involving groups specialized in "Extension Snatching" (buying existing extensions to push malicious updates).
## Detection Methods
- **Signature-based detection:** Monitoring for known malicious Extension IDs (refer to Socket report for the list of 16+ IDs).
- **Behavioral detection:**
- Monitoring for unauthorized WebSocket connections originating from browser processes.
- Detecting the modification of HTTP response headers (specifically `Content-Security-Policy`).
- **YARA rules:** Scanning for specific obfuscation patterns in `manifest.json` or background scripts of installed extensions.
## Mitigation Strategies
- **Prevention measures:**
- Implement an "Allow List" for browser extensions in corporate environments.
- Educate users on the risks of "ClickFix" lures and executing terminal commands provided by websites.
- **Hardening recommendations:**
- Enforce Multi-Factor Authentication (MFA) to mitigate the impact of stolen credentials.
- Use hardware security keys (U2F) which are resistant to the session/token theft methods used by this framework.
- Regularly audit installed extensions and remove those no longer in use or from unverified developers.
## Related Tools/Techniques
- **ClickFix:** A common social engineering technique used by various malware families (like ClearFake) to deliver payloads.
- **Wallet Drainers:** Similar to "Angel Drainer" or "Pink Drainer" logic implemented within a browser context.