ChromeLoader malware rages around the world, attacking both Windows and Mac

This month, ChromeLoader malware is growing strongly in number after destructive on a steady scale since the beginning of the year. This makes browser hacking a widespread threat.

ChromeLoader is a browser-intrusive malware capable of modifying the victim's web browser settings to display search results for spam software ads, run tags to access fake survey sites, and give fake gifts. impersonation, advertising adult games and dating sites.

Those behind this malware will get financial benefit through affiliate marketing system.

There is a lot of malware of this type but ChromeLoader stands out for its persistence, scale, and infection path through active abuse of PowerShell.

Abuse of PowerShell

According to Red Canary researchers, who have been monitoring ChromeLoader's activity since February, the operators use a malicious ISO archive to infect victims with malicious code.

Often malicious ISO files will be disguised as cracked software and games for victims to download and activate themselves. There are even ads on Twitter for cracked Android games with QR codes that lead directly to a malware download page.

ChromeLoader malware rages around the world, attacking both Windows and Mac Picture 1

When the user double-clicks the malicious ISO file, it will be mounted as a virtual CD-ROM drive. It will contain executable files with the .exe extension. When run it will fire up ChromeLoader and decode a PowerShell command with the ability to fetch the remote resource archive and load it as a Google Chrome extension.

Once done, PowerShell will delete scheduled tasks that have infected Chrome with an extension with the ability to silently infiltrate the browser and manipulate search results and other behaviors.

macOS is also attacked

The guys behind ChromeLoader also target computers running macOS. They want to manipulate both Chrome and Safari running on macOS.

The infection chain on macOS is similar to that on Windows, but instead of ISO, they use a DMG (Apple Disk Imgage) file, a format more common on Apple's operating system.

ChromeLoader malware rages around the world, attacking both Windows and Mac Picture 2

Furthermore, instead of executing the installer, the ChromeLoader variant on macOS uses the installer's bash script to download and extract the ChromeLoader exension in the "private/var/tmp" directory.

To stay present for as long as possible, ChromeLoader will add a preferences file ('plist') to the '/Library/LaunchAgents' folder. This ensures that every time a user logs into a graphical session, ChromeLoader's Bash script can continuously run.

Alternatively, you can also check other browser settings for anything unusual. If strange settings are detected, restore to factory mode to solve the problem.

Micah Soto

Update 31 May 2022

You should read it

May be interested

New ransomware appears attacking Windows operating system
a new ransomware service called eldorado appears to offer services to affiliate partners attacking windows systems and vmware esxi virtual machines.
How to Protect Yourself from the Latest WordPress Malware Attack
as one of the most popular website building tools in the world, wordpress is once again a target for malware.
Detecting dangerous backdoors targeting both Windows, macOS and Linux
international cybersecurity researchers have just issued an urgent notice about a new type of cross-platform malware called 'sysjoker' that has been appearing all over the world.
How to find and remove WMI Persistence malware from Windows PCs
wmi persistence refers to the attacker installing a script, specifically an event handler, that is always fired when a wmi event occurs.
What is Mirai Malware? Who is at risk of infection?
there are countless strains of malware out there that pose a threat to users, devices, and personal information. one such type of malware, called mirai, has caused trouble for users around the world.
Malware digs virtual money over antivirus programs, forcing Windows to crash
digging money for encryption is a new trend in the malware world, and recently, security company 360 total security has discovered a new malware that is extremely aggressive.
How many types of malware do you know and how to prevent them?
currently, computer criminals use a lot of different malware (malware) to attack the system. here are some of the most common malware types and ways to prevent them.
10 typical malware types
currently, more and more sophisticated and more malicious new malware types appear. anyone can know the harmful effects of malware, but not everyone knows how they work. this article will point out the 10 most dangerous types of malware ever.
What is Safe Malware? Why is it so dangerous?
remote access trojan (rat) is a type of malware that allows hackers to monitor and control the victim's computer or network.
The laptop contains six of the world's most dangerous malware being auctioned, starting at $ 268,000
a samsung nc10-14g 10.2-inch blue netbook laptop containing the most dangerous malware ever developed, named the persistence of chaos, is auctioned off with a starting amount of up to usd 268,000.

ChromeLoader malware rages around the world, attacking both Windows and Mac

Abuse of PowerShell

macOS is also attacked

You should read it

May be interested

Security solution