July 29, 2022

Volexity security experts have uncovered a malware campaign by a North Korean threat group identified as Kimsuky.

The campaign uses a malicious browser extension called SHARPEXT to steal emails from Google or Microsoft Edge users who read their webmail. The campaign supports three Chrome-based web browsers: Chrome, Edge and Whale.

The malicious extension is installed after a victim’s system is compromised with a custom VBS script. Here, attackers replace the ‘Preferences’ and ‘Secure Preferences’ with those downloaded from the malware’s command-and-control server.

After the new preferences files are installed, the web browser automatically loads the SHARPEXT extension.

SHARPEXT can be used to collect a wide range of information using commands listing previously collected emails from the victim, listing email domains with which the victim had previously communicated, blacklisting email senders, and adding a domain to the list of all domains viewed by the victim.

Others include uploading a new attachment to the remote server, uploading Gmail data to the remote server, and uploading AOL data to the remote server.

The sources for this piece include an article in BleepingComputer.