# Malicious Browser Extensions Ecosystem: Needle and Lunex Malware, Clean-Then-Update Extension Campaigns

> Intrinsec's CTI overview of the malicious browser extension ecosystem describes campaigns that publish clean extensions to build credibility and later push covert malicious updates, targeting cryptocurrency and authenticated sessions. Infrastructure analysis exposed C2 panels for the Needle and Lunex malware families, both of which deploy malicious browser extensions.

- **Published:** 2026-11-05T18:38:17Z
- **Last reviewed:** 2026-11-05T18:38:17Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5337
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5337.png
- **ID:** TL-2026-5337
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 26 (3 shown free below)
- **CVEs:** CVE-2023-20598

## Description

Intrinsec's CTI team (report TLP:CLEAR dated 2026-11-05, with an earlier March 2026 report shared with clients) reviews the malicious browser extension ecosystem. Described patterns include extensions that ship clean to gain trust and then receive silent, malicious updates, with theft of cryptocurrency and hijacking of authenticated sessions as primary goals. Intrinsec identified IP addresses exposing C2 panels for the Needle and Lunex malware families. For suspicious extensions found during an investigated incident, Intrinsec states no evidence of malicious activity was established at the time. The full PDF (IOCs, forum discussion) was not retrievable; technical detail below is taken from public reporting on the two named families.

Needle is a modular Golang infostealer / malware-as-a-service platform. Malwarebytes documents a chain delivered from a malicious trading website: a DLL-hijacking loader (iviewers.dll), a second-stage DLL, and process hollowing of Needle into RegAsm.exe, with a hidden ZIP (base.zip or meta.zip) unpacked by the 'ext' package. The browser extensions use Google-related names with popup.js, content.js and background.js and a cfg.json configuration giving full control of the browser: download interception, script injection, fake notifications and live browsing monitoring. Independent OTX-sourced analysis (2026-05-11) describes a browser-extension spoofer impersonating MetaMask, Phantom and Trust Wallet and a Rust desktop agent mimicking Exodus, Trezor and Ledger, with 1,932 victims (111 extension users, 1,821 desktop sessions), a C2 hosted on bulletproof ASN 202412 in Amsterdam, and an unencrypted API key embedded in the malware.

Lunex is a Russian-speaking MaaS platform first documented in June 2026 (six panels) and since grown to 28 panels across 13 countries. LunexLoader bypasses UAC via the CMSTPLUA COM object and uses BYOVD (the AMD driver PDFWKRNL.sys, CVE-2023-20598) to blind security processes. The Psychedelic Stealer payload was delivered via 100+ compromised Ukrainian websites using ClickFix-style fake Cloudflare verification (CERT-UA UAC-0277). It steals data from seven Chromium browsers and many crypto wallets, persists via Run key, hidden scheduled task 'psychedelicloveUtils' and a Chrome Native Messaging Host, and installs the LunarAxe extension (disguised as 'Microsoft Office Word Editor') paired with NaiveMess for filesystem access.

## MITRE ATT&CK

- T1204.002 User Execution: Malicious File
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1176 Software Extensions
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1574.001 DLL
- T1055.012 Process Injection: Process Hollowing
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1185 Browser Session Hijacking
- T1005 Data from Local System

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Needle Stealer Loader Chain: iviewers.dll Side-Load and Argument-less RegAsm.exe Hollowing** (`TL-2026-5337-SPL-001`)

Behaviour-first detection of the Needle (Golang infostealer MaaS) execution chain: the iviewers.dll DLL-hijacking loader and RegAsm.exe launched with no command-line arguments, the legitimate .NET utility hollowed to host Needle in memory. Source: Malwarebytes analysis of the malicious trading-website delivery chain.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1574.001, T1055.012, T1204.002
- **Data sources:** sysmon (EventCode 1, EventCode 7), windows_security, defender_xdr_DeviceImageLoadEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" ((EventCode=1 Image="*\\RegAsm.exe") OR (EventCode=7 ImageLoaded="*\\iviewers.dll"))
| eval signal=case(EventCode=7, "iviewers_dll_sideload_T1574.001", match(CommandLine, "(?i)regasm(\.exe)?\W*$"), "regasm_no_args_hollowing_T1055.012")
| where isnotnull(signal)
| stats count min(_time) as first_seen max(_time) as last_seen values(signal) as signals values(ParentImage) as parent_images values(ImageLoaded) as loaded_dll values(CommandLine) as command_lines by host, User, Image
```

### Microsoft KQL

```kql
union
(
    DeviceImageLoadEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "iviewers.dll"
    | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, ParentProcess = InitiatingProcessFileName, ParentCmd = InitiatingProcessCommandLine, FileName, FolderPath, SHA256, Signal = "iviewers_dll_sideload_T1574.001"
),
(
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "RegAsm.exe"
    | where ProcessCommandLine matches regex @"(?i)regasm(\.exe)?\W*$"
    | project Timestamp, DeviceName, AccountName, ParentProcess = InitiatingProcessFileName, ParentCmd = InitiatingProcessCommandLine, FileName, FolderPath, SHA256, Signal = "regasm_no_args_hollowing_T1055.012"
)
| order by Timestamp desc
```

### Sigma

```yaml
title: Needle Stealer Loader iviewers.dll DLL Side-Loading
id: 5337a001-0001-4c3e-8a5b-0c0d1e2f3a01
status: experimental
description: Detects loading of iviewers.dll, the stage-1 DLL-hijacking loader used in the Needle stealer chain delivered from a malicious trading website.
references:
  - https://www.malwarebytes.com/blog/threat-intel/2026/04/malicious-trading-website-drop-malware-that-hands-over-your-browser-to-attackers
  - https://www.intrinsec.com/malicious-browser-extensions-ecosystem-overview/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
  - attack.defense-evasion
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: '\iviewers.dll'
  condition: selection
falsepositives:
  - Unlikely, a benign third-party image viewer shipping a library with this exact name
level: high
---
title: Needle Stealer RegAsm.exe Launched Without Arguments
id: 5337a001-0002-4c3e-8a5b-0c0d1e2f3a02
status: experimental
description: Detects RegAsm.exe started with no arguments, the process-hollowing host used to run Needle in memory.
references:
  - https://www.malwarebytes.com/blog/threat-intel/2026/04/malicious-trading-website-drop-malware-that-hands-over-your-browser-to-attackers
  - https://www.intrinsec.com/malicious-browser-extensions-ecosystem-overview/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
  - attack.defense-evasion
  - attack.t1055.012
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\RegAsm.exe'
  selection_noargs:
    CommandLine|endswith:
      - 'RegAsm.exe'
      - 'RegAsm.exe"'
      - 'RegAsm.exe '
      - 'RegAsm.exe" '
      - 'RegAsm'
  condition: selection_img and selection_noargs
falsepositives:
  - Developer tooling or installers invoking RegAsm.exe with no arguments (rare)
level: high

```

**Known false positives:**

- Developer or build tooling that launches RegAsm.exe with no arguments
- Third-party software shipping a benign library named iviewers.dll

**Tuning notes:** Sysmon EventCode 7 must be enabled with image-load logging for non-system paths. Adjust index=sysmon to your Sysmon index. Exclude known build servers and Visual Studio parents (devenv.exe, msbuild.exe) from the RegAsm branch. Treat any iviewers.dll load outside a verified image-viewer install path as high priority.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ClickFix Fake-Verification PowerShell One-Liner Launched from Explorer (locked: unlock with TL Creds)
- Browser Credential and Session Cookie Store Harvesting (Needle / Lunex Stealers) (locked: unlock with TL Creds)
- Lunex MaaS C2 Panel and Community-Observed Sibling Infrastructure Connections (locked: unlock with TL Creds)
- LunexLoader BYOVD ([indicator]) and CMSTPLUA UAC Bypass (locked: unlock with TL Creds)
- Malicious Chromium Extension Persistence: Native Messaging Host and Forced Install Policy (locked: unlock with TL Creds)
- DNS Resolution of Needle C2 and Lunex Phishing Infrastructure Domains (locked: unlock with TL Creds)
- Lunex Psychedelic Stealer Persistence: psychedelicloveUtils Task and Run Key (locked: unlock with TL Creds)
- Needle Stealer C2: Known C2 IPs and Hollowed RegAsm.exe Outbound Traffic (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 26)

Defanged, TLP:CLEAR.

- IP address: `178.16.55[.]234`
- Domain: `coretest[.]digital`
- File hash: `95dcac62fc15e99d112d812f7687292e34de0e8e0a39e4f12082f726fa1b50ed`

Full set of 26 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Malicious browser extensions ecosystem overview (Intrinsec)](https://www.intrinsec.com/malicious-browser-extensions-ecosystem-overview/)
- [Intrinsec full report PDF: TLP-CLEAR Malicious extensions](https://www.intrinsec.com/wp-content/uploads/2026/11/TLP-CLEAR-20261105-Malicious-extensions.pdf)
- [Malicious trading website drops malware that hands your browser to attackers (Malwarebytes)](https://www.malwarebytes.com/blog/threat-intel/2026/04/malicious-trading-website-drop-malware-that-hands-over-your-browser-to-attackers)
- [Needle: Inside a Modular Crypto-Stealing C2 That Left Its Keys in the Malware (OffSeq radar / OTX)](https://radar.offseq.com/threat/needle-inside-a-modular-crypto-stealing-c2-that-le-23305409)
- [Lunex Stealer abuses AMD driver (The Hacker News)](https://thehackernews.com/2026/09/lunex-stealer-abuses-amd-driver-to.html)
- [ClickFix campaign in Ukraine delivers Lunex stealer (The Record)](https://therecord.media/clickfix-campaign-ukraine-lunex-stealer)
- [100 compromised websites use fake Cloudflare checks (The Hacker News)](https://thehackernews.com/2026/10/100-compromised-websites-use-fake.html)
- [Lunex malware platform uses Psychedelic Stealer via compromised Ukrainian sites (SC Media)](https://www.scworld.com/brief/lunex-malware-platform-uses-psychedelic-stealer-via-compromised-ukrainian-sites)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5337