How criminals leverage a Firefox fake extension to target Gmail accounts
Recently, malicious campaigns have been using fake web-browsers extensions commonly disseminated via Google Ads and other channels.
This article will Proofpoint researchers found a new Firefox fake extension active since March 2020 that targets Tibetan organizations globally. The fake extension, named FriarFox, is related to the TA413 gangue also observed delivering both Scanbox and Sepulcher malware campaigns against Tibetan organizations in early 2021.
How FriarFox spreads
The malicious campaign associated with the FriarFox fake extension impersonates the Tibetan Women’s Association using an email with the following subject: “Inside Tibet and from the Tibetan exile community.”
In detail, the email is sent from a known account that impersonates the Bureau of His Holiness the Dalai Lama in India and used by TA413 for several years. As observed in Figure 1, after clicking on an URL in the email body, a fake Adobe Flash installation screen is presented to convince the end-user to install the FriarFox Firefox extension.
Figure 1: High-level diagram of FriarFox fake extension.
After accessing the fake Adobe Flash page, the user can add the extension as presented below. It’s also important to highlight that Adobe Flash is an EOF software, so internet end-users should be warned of this and about the critical consequences of installing extensions of this nature.
Figure 2: FriarFox extension installed on the victim’s web browser.
FriarFix data exfiltration
- Search emails
- Archive emails
- Receive Gmail notifications
- Read emails
- Alter Firefox browser audio and visual alert features for the FriarFox extension
- Label emails
- Marks emails as spam
- Delete messages
- Refresh inbox
- Forward emails
- Perform function searches
- Delete messages from Gmail trash
- Send mail from the compromised account
- Access user data for all websites
- Display notifications
- Read and modify privacy settings
- Access browser tabs
Diving into the details
The FriarFox extension seems based on an open-source tool named “Gmail Notifier (restartless).” The legitimate extension allows users to receive notifications and perform specific Gmail actions on up to five Gmail accounts actively logged in simultaneously.
To carry out the malicious campaign, TA413 gangue changed several sections of the open-source extension Gmail Notifier to enhance its malicious functionality, conceal browser alerts to victims and disguise the extension as an Adobe Flash-related tool. In detail, the most notable changes were:
- The PNG icon appears as an Adobe Flash icon in the browser extension menu
- The extension metadata description supports refers a Flash update providing the description displayed in the browser extension menu
- All audio and visual browser alerts are set not to alert active users after the time of installation.
Figure 3: Scanbox JS malware obfuscation layer.
After deobfuscating the malware, the configuration file can be observed, with the C2 server hardcoded and other configuration data.
Figure 4: Scanbox configuration deobfuscated.
FriarFox is a complete browser extension capable of exfiltrating data from end-users Gmail Accounts and performing total control of the victim’s web browser. The usage of browser extensions to target the private Gmail accounts of users combined with the delivery of Scanbox malware demonstrates the malleability of TA413 when targeting communities.
Although there is no perfect formulate to fight attacks of this nature, it’s possible to mitigate in part the initial installation of browsers fake extensions following the security best practices, namely:
- Protect yourself against phishing attacks, and don’t click on untrusted/unknown URLs
- Check the publisher of the browser extension every time
- Avoid attachments from unofficial sources
In addition, watch out for updates. Extensions by default automatically will update themselves, which is helpful for security. Keep an eye out for unusual behavior and start taking malware protection seriously!
- FriarFox analysis, Proofpoint
We've encountered a new and totally unexpected error.
Get instant boot camp pricing
A new tab for your requested boot camp pricing will open in 5 seconds. If it doesn't open, click here.