{"id":46862,"date":"2022-05-27T15:35:04","date_gmt":"2022-05-27T15:35:04","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/33496\/Malware-Uses-PowerShell-To-Inject-Malicious-Extension-Into-Chrome.html"},"modified":"2022-05-27T15:35:04","modified_gmt":"2022-05-27T15:35:04","slug":"malware-uses-powershell-to-inject-malicious-extension-into-chrome","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/malware-uses-powershell-to-inject-malicious-extension-into-chrome\/","title":{"rendered":"Malware Uses PowerShell To Inject Malicious Extension Into Chrome"},"content":{"rendered":"

A strain of Windows uses PowerShell to add a malicious extension to a victim’s Chrome browser for nefarious purposes. A macOS variant exists that uses Bash to achieve the same and also targets Safari.<\/p>\n

The makers of the ChromeLoader software nasty ensure their malware is persistent once on a system and is difficult to find and remove, according to threat hunters at cybersecurity shop Red Canary, who have been tracking the strain since early February and have seen a flurry of recent activity.<\/p>\n

“We first encountered this threat after detecting encoded PowerShell commands referencing a scheduled task called ‘ChromeLoader’ \u2013 and only later learned that we were catching ChromeLoader in the middle stage of its deployment,” Aedan Russell, detection engineer at Red Canary, wrote in a blog post<\/a> this week.<\/p>\n