We will protect your money… Just give it to us.

We will protect your money… Just give it to us 😏

At the beginning of the year, specialists from the cyber intelligence group of the TI department at the Positive Technologies Security Expert Center discovered a malicious email that offered to download a file from a suspicious website.

The identified attack chain leads to the installation of a malicious extension targeting users in Brazil in Google Chrome 👨‍💻

A more detailed investigation revealed that, in addition to the discovered chain, there is an alternative attack vector aimed at installing remote administration tools (e.g., MeshAgent, PDQ Connect Agent, ScreenConnect).

At the time of the study, statistics showed over 700 downloads of the malicious extension throughout its existence in the Chrome Web Store (about 2.5 months). Additionally, considering the second attack chain, approximately 70 companies were infected, whose infrastructure was used to distribute phishing emails.

😏 You can read about all this and more in our new study “Operation Phantom Enigma”.

#TI #Malware #Phishing
@ptescalator