Threat video1:00
QuickLens and ShotBird Chrome Extension Ownership Hijack
Hijacked QuickLens and ShotBird extensions reached approximately 7,800 users. 9 detection rules, 25 IOCs, 18 ATT&CK techniques and a free Splunk SPL rule.
Read the full threat intel for QuickLens and ShotBird Chrome Extension Ownership Hijack →
Chapters
- 0:00The hookAbout two Chrome extensions compromised ~7,800 users
- 0:05The storyAttackers seized both extensions through marketplace.
- 0:12Attack pathThreat actors seized two Chrome extensions and deployed updates.
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromise14 indicators to hunt: 1 IP, 7 domains and 1 URL, and more.
- 0:39MITRE ATT&CK techniques18 ATT&CK techniques, from resource development to impact.
- 0:43Remediation8 steps now: Remove QuickLens extension.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About two Chrome extensions compromised ~7,800 users
0:05Attackers seized both extensions through marketplace.
0:09Malicious versions deployed with C-two.
0:12Threat actors seized two Chrome extensions and deployed updates.
0:16Both established command-and-control channels.
0:19Injected malicious JavaScript to steal crypto wallets and credentials.
0:24Exfiltrated all stolen data.
0:28No threat actor is attributed. Confidence: none.
0:3314 indicators to hunt: 1 IP, 7 domains and 1 URL, and more.
0:3918 ATT&CK techniques, from resource development to impact.
0:448 steps now: Remove QuickLens extension.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.