Security News > 2021 > February > Chinese Hackers Using Firefox Extension to Spy On Tibetan Organizations

Cybersecurity researchers today unwrapped a new campaign aimed at spying on vulnerable Tibetan communities globally by deploying a malicious Firefox extension on target systems.

"Threat actors aligned with the Chinese Communist Party's state interests delivered a customized malicious Mozilla Firefox browser extension that facilitated access and control of users' Gmail accounts," Proofpoint said in an analysis.

The emails contain a malicious URL, supposedly a link to YouTube, when in fact, it takes users to a fake "Adobe Flash Player Update" landing page where they are prompted to install a Firefox extension that Proofpoint calls "FriarFox."

"In recent campaigns identified in February 2021, browser extension delivery domains have prompted users to 'Switch to the Firefox Browser' when accessing malicious domains using the Google Chrome Browser," the researchers said.

The introduction of the FriarFox browser extension in TA413's arsenal points to APT actors' "Insatiable hunger" for access to cloud-based email accounts, says Sherrod DeGrippo, Proofpoint's senior director of threat research and detection.

"Almost any other account password can be reset once attackers have access to someone's email account. Threat actors can also use compromised email accounts to send email from that account using the user's email signature and contact list, which makes those messages extremely convincing."

News URL

http://feedproxy.google.com/~r/TheHackersNews/~3/wMmRJcey3oY/chinese-hackers-using-firefox-extension.html