Skip to main content

Hackers use Rilide browser extension to bypass 2FA, steal crypto


Jasper_The_Rasper
Moderator
Forum|alt.badge.img+54

April 6, 2023 By Bill Toulas

 

Security researchers discovered a new malicious browser extension called Rilide, that targets Chromium-based products like Google Chrome, Brave, Opera, and Microsoft Edge.

The malware is designed to monitor browser activity, take screenshots, and steal cryptocurrency through scripts injected in web pages.

Researchers at Trustwave SpiderLabs found that Rilide mimicked benign Google Drive extensions to hide in plain sight while abusing built-in Chrome functionalities.

The cybersecurity company detected two separate campaigns that distributed Rilide. One was using Google Ads and Aurora Stealer to load the extension using a Rust loader. The other one distributed the malicious extension using the Ekipa remote access trojan (RAT).

 

Two campaigns pushing Rilide
Two campaigns pushing Rilide (Trustwave)

 

>> Full Article <<

0 replies

Be the first to reply!

Reply