Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

These malicious Google Chrome extensions could let hackers steal your Gmail messages

Google Chrome browser app on iPhone

A malicious browser extension for Chrome and other Chromium-based browsers capable of stealing the contents of your Gmail email account has been discovered by security researchers.

The malware campaign was spotted by two national security agencies - the German Federal Office for the Protection of the Constitution, and the National Intelligence Service of the Republic of Korea. 

These two agencies issued a joint statement, warning about the campaign, urging people to be vigilant, but particularly diplomats, journalists, university professors, politicians, and government employees, who are all reportedly the main targets.

Delivered via phishing

AF is a Google Chrome add-on distributed by a threat actor known as Kimsuky (or Thallium). This threat actor is based in North Korea, the two agencies claim, and allegedly targets high-profile individuals in their cyber-espionage programs. 

While initially focused on South Korean targets, Thallium recently expanded its target list into Europe, and the United States. 

AF is delivered to its victims via phishing. The group would send out the usual “urgent” email, telling the victim to download the add-on on their endpoint. If installed, the malware won’t show up in the list of add-ons on Chrome, and will only be visible in the extension list. Once installed, it only takes one visit to Gmail for the add-on to run and extract all of its activities. 

Kimsuky seems to be a state-sponsored actor focused on cyber-espionage and intelligence gathering. According to CISA, the group has been active for more than a decade. 

In 2015, it was accused of stealing sensitive data from Korea Hydro & Nuclear Power, and four years later, in 2019, it was accused of targeting retired South Korean diplomats, military and government officials. Two years ago, Kimsuky was accused of lurking in the internal networks belonging to the Korea Atomic Energy Research Institute.

Via: BleepingComputer

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.