A Browsing Challenge

Once malicious browser extensions are detected, analysts will quickly want to know what to do to stop the bleeding. Are any external communications related to this? Is any information being exfiltrated? What kinds of attacks are occurring internally? Is any pivoting/ lateral movement behavior happening with stolen credentials, possibly accessing more sensitive data? They’ll also quickly want to know who else is affected—spanning both devices, and users—when they were infected, which browsers and versions are impacted, whether the decision to install the extension was completely voluntary and more.

security today logo

Read more …

Security Analysis