North Korean hackers plot Gmail theft attacks via Chrome extension

Shutterstock

South Korea and Germany have launched a joint cyber security advisory warning that North Korean hackers are attempting to steal Gmail email messages through a malicious Chrome extension.

The Nationwide Intelligence Support (NIS) of the Republic of Korea and the German Bundesamt für Verfassungsschutz (BfV) have warned that Kimsuky, a team of North Korean hackers also tracked as ‘Velvet Chollima’ and ‘Thallium’, are concentrating their attacks on scientists concentrating on North Korea and the Korean Peninsula.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

The attackers made use of a spear phishing email to install a destructive Chromium extension via a link. When the target logs into their Gmail, the extension is activated and sends the stolen email written content to the attacker’s server, bypassing security configurations.

The hacking team also utilizes Android malware to get even further accessibility to a victim’s gadget. Immediately after stealing a victim’s Google account information as a result of the phishing strategy, the attacker also registers a malicious application on the Google Perform Console and provides the account as a test target.

Assessment of the attacks confirmed that the attacker then logs in to a victim’s Google account on a Laptop and requests set up of the destructive app onto the victim’s smartphone, which is joined to the Google account. This is done as a result of Google Play’s synchronisation attribute.

Kimsuky tends to make use of three malware strains known as FastFire, FastViewer, and FastSpy, in accordance to Cyware.  The malware will allow an attacker to track users’ locations, acquire keystrokes, record camera details, intercept phone phone calls, and conserve paperwork.

The North Korean hacking group has utilised malicious browser extensions in the earlier to steal knowledge from Gmail and AOL classes.

Cyber security firm Volexity learned the extension, referred to as ‘SHARPEXT’, in August 2022. The extension monitored webpages to sift by e-mails and attachments from victims’ mailboxes.

The adware was joined to a menace actor identified as SharpTongue, an additional acknowledged alias of Kimsuky. The browser extension was also mounted using spear phishing and social engineering tactics, by encouraging victims to access a destructive doc.

In July 2022, Kimsuky was named on the US State Office list of North Korean hacking teams on which it was actively trying to get data, putting up a $10 million dollar reward for practical submissions.

Other infamous teams on the list included Lazarus Team – the team blamed for 2017’s WannaCry attack, Andariel, and Bluenoroff.