Скачать или смотреть Browser Syncjacking Attack (Part 2): Browser & Device Hijacking

A malicious extension monitors and intercepts a legitimate download, such as a Zoom update, and replaces it with the attacker’s executable, which contains an enrollment token and registry entry to turn the victim’s browser into a managed browser. Thinking that they downloaded a Zoom update, the victim executes the file, which ends up installing a registry entry that turns the browser into a managed browser controlled by the attacker’s Google Workspace.

With the same downloaded file above, the attacker can additionally insert registry entries required for the malicious extension to message native apps. This allows the extension to directly interact with local apps without further authentication. Once the connection is established, attackers can use the extension in conjunction with the local shell, essentially providing full access to all applications and confidential data on the device.

Learn more about the attack at https://sqrx.com/research

Follow us on:

  / getsquarex  
  / getsquarex  
  / getsquarex  
  / getsquarex  

🔔 Subscribe for more cybersecurity research and emerging attack techniques!

#Cybersecurity #BrowserSecurity #Chrome #InfoSec #SecurityAwareness