ChromeLoader: New Stubborn Malware Campaign

ChromeLoader: New Stubborn Malware Campaign

A new browser hijacker/adware campaign named ChromeLoader also known as Choziosi Loader and ChromeBack was discovered. Despite using simple malicious advertisements, the malware became widespread, potentially leaking data from thousands of users and organizations.

ChromeLoader Malware

ChromeLoader is a multi-stage malware family. Each variant contains different stages throughout its infection chain, including malicious browser extensions used in all variants.

Instead of more traditional malware like a Windows executable (.exe) or Dynamic Link Library (.dll), the malware authors used a browser extension as their final payload.

The browser extension serves as adware and an infostealer, leaking all of the user’s search engine queries. We discovered significant changes and additions of capabilities throughout this campaign’s evolution, and we predict further changes as this campaign continues.

Paloalto says, it made the investigation process significantly easier. Palo Alto Networks customers using Cortex XDR and WildFire receive protections against this newly discovered malware out of the box.

In fact, it improved the research ability so much that were able to detect two new versions of this malware – the first one and the latest, which have never been linked to this malware family before.

File Hash

  • 0a80192cb1f31ef0a9d48932510f6956
  • e727a8e80e3831161a7c980bb47a9fa
  • 4ea92236c393a737872fa7d752224c8b

Follow us for more, Facebook, Twitter, LinkedIn and Instagram

About the Author:

FirstHackersNews- Identifies Security

Leave A Comment

Subscribe to our newsletter to receive security tips everday!