Bei 840.000 Installationen wurden schädliche GhostPoster-Browsererweiterungen gefunden

Another set of 17 malicious extensions linked to the GhostPoster campaign has been discovered in Chrome, Firefox, and Edge stores, where they accumulated a total of 840,000 installations.

The GhostPoster campaign was first reported by Koi Security researchers in December. They found 17 extensions that were hiding malicious JavaScript code in their logo images, which monitored browser activity and planted a backdoor.

The code fetches a heavily obfuscated payload from an external resource, which tracks the victim’s browsing activity, hijacks affiliate links on major e-commerce platforms, and injects invisible iframes for ad fraud and click fraud.

A new report from browser security platform LayerX indicates that the campaign is still ongoing despite being exposed, and the following 17 extensions are part of it:

Google Translate in Right Click – 522,398 installs
Translate Selected Text with Google – 159,645 installs
Ads Block Ultimate – 48,078 installs
Floating Player – PiP Mode – 40,824 installs
Convert Everything – 17,171 installs
Youtube Download – 11,458 installs
One Key Translate – 10,785 installs
AdBlocker – 10,155 installs
Save Image to Pinterest on Right Click – 6,517 installs
Instagram Downloader – 3,807 installs
RSS Feed – 2,781 installs
Cool Cursor – 2,254 installs
Full Page Screenshot – 2,000 installs
Amazon Price History – 1,197 installs
Color Enhancer – 712 installs
Translate Selected Text with Right Click – 283 installs
Page Screenshot Clipper – 86 installs

https://www.bleepingcomputer.com/news/security/malicious-ghostposter-browser-extensions-found-with-840-000-installs/

Oh it’s like Honey?