Tag

Chromium Based Browsers

All articles tagged with #chromium based browsers

MacOS AmnesiaStealer Enables Live, Authenticated Browser Session Hijacking
security8 days ago

MacOS AmnesiaStealer Enables Live, Authenticated Browser Session Hijacking

A new macOS information-stealer, AmnesiaStealer, uses a streaming module to clone a victim’s Chromium profile into a headless browser, enabling live, authenticated-session control across 16 Chromium-based browsers via WebSocket and the Chrome DevTools Protocol. It can exfiltrate cookies, saved logins, browsing history, wallets, notes, documents, and keychain data, and is distributed through ClickFix on a fake GitHub page with a password-protected ZIP. This marks the first documented macOS malware to pair a cloned Chromium profile with CDP-based live remote control, allowing attackers to view a live screencast (~3fps) and execute actions through the victim’s browser. Users should avoid unknown terminal commands and maintain strong security practices.

Rilide Malware Evolves: Chrome Extension Manifest V3 and PowerPoint Guides Target Enterprise Users
browser-security-malware3 years ago

Rilide Malware Evolves: Chrome Extension Manifest V3 and PowerPoint Guides Target Enterprise Users

Researchers have discovered an updated version of the Rilide malware that targets Chromium-based web browsers, exhibiting a higher level of sophistication and adapting to the Chrome Extension Manifest V3. The malware is capable of stealing sensitive data and cryptocurrency, disabling other browser add-ons, harvesting browsing history and cookies, collecting login credentials, taking screenshots, and injecting malicious scripts. It is sold on dark web forums for $5,000. The updated version of Rilide overlaps with malware known as CookieGenesis and uses the controversial Chrome Extension Manifest V3. The malware impersonates legitimate apps and employs vishing tactics to deceive users into installing it. The threat actors behind Rilide also use a PowerShell loader to modify the browser's Secure Preferences file and have connections to other websites serving malware.