Malicious Firefox Extension that Allows Attackers to Access Gmail debenhams cc, woolworths cc
Proofpoint Threat Research has tracked low-volume phishing campaigns targeting Tibetan organizations globally. In January and February 2021, experts observed threat actors aligned with the Chinese Communist Party’s state interests delivered a customized malicious Mozilla Firefox browser extension that facilitated access and control of users’ Gmail accounts.
Proofpoint has named this malicious browser extension “FriarFox” and attributes this activity to TA413, who in addition to the FriarFox browser extension, was also observed delivering both Scanbox and Sepulcher malware to Tibetan organizations in early 2021.
The previously reported Sepulcher malware and its links to the Lucky Cat and Exile Rat malware campaigns targeted Tibetan organizations.
A phishing email was detected which targeted several Tibetan organizations in late January 2021. The email imitated the “Tibetan Women’s Association” in the From field and utilized the email subject “Inside Tibet and from the Tibetan exile community”.
These scripts determine whether to deliver the malicious FireFox Browser extension (“.XPI” file) that Proofpoint has named “FriarFox”. XPI files are compressed installation archives used by various Mozilla applications and contain the contents of a FireFox browser extension.
The use of landing pages for JS redirection is a technique commonly used in watering hole attacks. In this case, the domain is controlled by the threat actors, and the redirection is obtained via a malicious URL contained within a phishing email.
Threat actors appear to be targeting users that are utilizing a Firefox Browser and are utilizing Gmail in that browser. The user must access the URL from a FireFox browser to receive the browser extension.
Additionally, it appeared that the user must be actively logged in to a Gmail account with that browser to successfully install the malicious XPI file.
After the installation of the FriarFox browser extension, threat actors gain the following access to the user’s Gmail account and FireFox browser data included below.
Gmail Access: Search emails, Archive emails, Receive Gmail notifications, Read emails, Alter FireFox browser audio and visual alert features for the FriarFox extension, Label emails, Marks emails as spam, Delete messages, Refresh inbox, Forward emails, Perform function searches, Delete messages from Gmail trash, Send mail from the compromised account.
FireFox Browser Access – (Based on Granted browser permissions): Access user data for all websites, Display notifications, Read and modify privacy settings, Access browser tabs.
It is largely based on an open-source tool named “Gmail Notifier (restartless)”. This is a free tool available on Github, the Mozilla Firefox Browser ADD-ONS store, and the QQ App store among other locations.
In recent campaigns identified in February 2021, browser extension delivery domains have prompted users to “Switch to the Firefox Browser” when accessing malicious domains using the Google Chrome Browser.
The threat actors hide FriarFox’s existence and their usage of the tool by altering the following:
Scanbox has been used in numerous campaigns to target the Tibetan Diaspora along with other ethnic minorities often targeted by groups aligned with the Chinese state interests. The tool is capable of tracking visitors to specific websites, performing keylogging, and collecting user data that can be leveraged in future intrusion attempts.
TA413 appears to be modulating their tools and techniques while continuing to rely on proven social engineering techniques. TA413 combines modified open-source tools, dated shared reconnaissance frameworks, a variety of delivery vectors, and very targeted social engineering tactics.
The result is that this group finds mileage from previously disclosed tools like Scanbox and Royal Road by varying the method of their introduction to the victim environment.
TA413 appears to be pivoting to modified open source tooling to compromise the global dissident organizations they have been tasked with surveilling. Unlike many APT groups, the public disclosure of campaigns, tools, and infrastructure has not led to significant TA413 operational changes.
debenhams cc woolworths cc