One of the Rilide samples is spread through a malicious Microsoft Publisher file. The loader changes the browsers’ LNK shortcut file and employs the “–load-extension” command line switch to launch the add-on. Until now, researchers discovered two malicious campaigns that aim to install the Rilide extension: Ekipa RAT and Aurora Stealer.īoth attack chains use the execution of a Rust-based loader. Source How Is the New Rilide Malware Installed GitHub has taken down the account in question. According to TheHackerNews:įurthermore, a command-and-control (C2) address specified in the Rilide code has made it possible to identify various GitHub repositories belonging to a user named gulantin that contain loaders for the extension. One of the interesting features implemented in the leaked source code is the malware`s ability to swap cryptocurrency wallet addresses by using an actor-controlled address hard-coded in the sample.Īs the identity of the threat actor using Rilide is still unknown, a command-and-control server address that appears in the exposed code might bring some leads. Also, they found part of the new malware`s source code was leaked on underground forums. Hackers can also use Rilide for spying activities, like monitoring browsing history and taking screenshots.Īccording to researchers, other similar browser extensions are advertised and ready to be used. Snatching cryptocurrency is not the only superpower the new malware has.

The next step is to steal their cryptocurrencies. Using forged dialogs, the malware lures unsuspicious users to disclose their two-factor authentication (2FA). But what makes it stand out from the crowd is the capability to simulate dialogs. Just like other malware strains, Rilide also uses malicious browser extensions. The new Rilide malware targets Chromium-based browsers like Google Chrome, Microsoft Edge, Brave, and Opera.

Researchers discovered a new malware that fakes legitimate Google Drive extensions to inject malicious scripts and steal cryptocurrency.

Chromium github