Security researchers discovered a new malicious browser extension called Rilide, that targets Chromium-based products like Google Chrome, Brave, Opera, and Microsoft Edge.
The malware is designed to monitor browser activity, take screenshots, and steal cryptocurrency and email account credentials through scripts injected into web pages.
It was found that the “Rilide” mimicked benign Google Drive extensions to hide in plain sight while abusing built-in Chrome functionalities.
Two separate campaigns were detected that distributed Rilide. One was using Google Ads and Aurora Stealer to load the extension using a Rust loader. The other one distributed the malicious extension using the Ekipa remote access trojan (RAT).
While the origin of the malware is unknown, it was reported that it overlaps with similar extensions sold to cybercriminals. At the same time, portions of its code were recently leaked on an underground forum due to a dispute between cybercriminals over unresolved payment.
A parasite in the browser
Rilide’s loader modifies the web browser shortcut files to automate the execution of the malicious extension that is dropped on the compromised system.
Malicious extension on Edge (Trustwave)Upon execution, the malware runs a script to attach a listener that monitors when the victim switches tabs, receives web content, or webpages finish loading. It also checks if the current site matches a list of targets available from the command and control (C2) server.
If there’s a match, the extension loads additional scripts injected into the webpage to steal from the victim information related to cryptocurrencies, email account credentials, etc.
The extension also disables ‘Content Security Policy,’ a security feature designed to protect against cross-site scripting (XSS) attacks, to freely load external resources that the browser would generally block.
In addition to the above, the extension regularly exfiltrates browsing history and can also capture screenshots and send them to the C2.
Rilide’s capabilities graph (Trustwave)
Bypassing two-factor authentication
An interesting feature of Rilide is its 2FA-bypassing system, which uses forged dialogs to deceive victims into entering their temporary codes.
The system is activated when the victim initiates a cryptocurrency withdrawal request to an exchange service that Rilide targets. The malware jumps in immediately to inject the script in the background and process the request automatically.
Once the user enters their code on the fake dialog, Rilide uses it to complete the withdrawal process to the threat actor’s wallet address.
The withdrawal request email is replaced with a device authorization request tricking the user into providing the authorization code.
Replacing the legitimate email (right) while extracting the 2FA code (Trustwave)
Rilide showcases the growing sophistication of malicious browser extensions that now come with live monitoring and automated money-stealing systems.
While the roll-out of Manifest v3 on all Chromium-based browsers will improve resistance against malicious extensions, many speculate it won’t eliminate the problem.
Source: BleepingComputer, TrustWave