Threat video1:00
Needle Stealer and Lunex Extensions: Detection & IOCs
Needle and Lunex stealers push clean extensions, then malicious updates that hit crypto and sessions: 26 IOCs, 9 detection rules, a free Splunk SPL rule.
Read the full threat intel for Needle Stealer and Lunex Extensions: Detection & IOCs →
Chapters
- 0:00The hookMalicious extensions steal credentials and cryptocurrencies.
- 0:05The storyMalware ships clean extensions.
- 0:11Attack pathClickFix bypasses UAC, delivers an extension.
- 0:25AttributionNo threat actor is attributed.
- 0:30Indicators of compromise23 indicators to hunt: 9 IPs, 9 domains and 2 SHA-256 hashes, and more.
- 0:39MITRE ATT&CK techniques14 ATT&CK techniques, from execution to collection.
- 0:43Remediation4 steps now: Block the listed Needle and Lunex C2 domains and IPs.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Malicious extensions steal credentials and cryptocurrencies.
0:05Malware ships clean extensions.
0:07Then silent updates steal credentials and cryptos.
0:11ClickFix bypasses UAC, delivers an extension.
0:15It steals credentials and session data.
0:18Hijacks authenticated browser sessions.
0:20Sends data to a MaaS C2 panel.
0:26No threat actor is attributed. Confidence: low.
0:3023 indicators to hunt: 9 IPs, 9 domains and 2 SHA-256 hashes, and more.
0:3914 ATT&CK techniques, from execution to collection.
0:444 steps now: Block the listed Needle and Lunex C2 domains and IPs.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.