New Version of Rilide Data Theft Malware Adapts to Chrome Extension Manifest V3

Cybersecurity scientists have learned a new edition of malware named Rilide that targets Chromium-dependent web browsers to steal sensitive data and steal cryptocurrency.

“It reveals a increased degree of sophistication by modular style, code obfuscation, adoption to the Chrome Extension Manifest V3, and more capabilities this kind of as the capability to exfiltrate stolen info to a Telegram channel or interval-based screenshot captures,” Trustwave security researcher Pawel Knapczyk reported in a report shared with The Hacker Information.

Rilide was 1st documented by the cybersecurity business in April 2023, uncovering two distinctive attack chains that created use of Ekipa RAT and Aurora Stealer to deploy rogue browser extensions able of data and crypto theft. It really is sold on dark web message boards by an actor named “friezer” for $5,000.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The malware is equipped with a large selection of functions that let it to disable other browser add-ons, harvest searching background and cookies, obtain login credentials, acquire screenshots, and inject destructive scripts to withdraw cash from various cryptocurrency exchanges.

The current model also overlaps with malware tracked by Trellix beneath the name CookieGenesis, with the extension now generating use of Chrome Extension Manifest V3, a controversial application programming interface (API) modify launched by Google that aims to curtail wide entry provided to extensions.

“With security in brain, one of the new significant improvements is that extensions cannot load distant JavaScript code and execute arbitrary strings,” Knapczyk explained. “Exclusively, all logic have to be incorporated in the extension bundle as a result letting the far more trusted and productive review system for the extensions submitted to the Chrome Web Retail outlet.”

This has led to a complete refactor of Rilide’s main capabilities, Trustwave claimed, including the malware relies on the use of inline occasions to execute destructive JavaScript code.

Two Rilide artifacts detected in the wild have been observed to impersonate Palo Alto Networks’ GlobalProtect application to deceive unsuspecting buyers into installing the malware as aspect of 3 various strategies. One particular set of attacks are developed to singled out buyers in Australia and the U.K.

It is suspected that the danger actors use bogus landing internet pages hosting legit AnyDesk remote desktop software and employ vishing strategies to guidebook prospective targets to put in the software, and subsequently leverage the distant access to deploy the malware.

An additional major update to the modus operandi will involve the use of a PowerShell loader to modify the browser’s Protected Choices file – which retains the point out of a user’s own browsing practical experience – to launch the software with the extension loaded completely.

A further more examination of the command-and-manage (C2) domain primarily based on the registrant details shows a link to a greater pool of internet websites, several of which have been observed serving malware such as Bumblebee, IcedID, and Phorpiex.

It can be worthy of noting that resource code of the Rilide extension was leaked in February 2023, boosting the risk that menace actors other than the initial author could possibly have picked up the growth initiatives.

Discovered this write-up attention-grabbing? Abide by us on Twitter  and LinkedIn to study a lot more unique information we put up.