microsoft edge extensions injecting ads into

Once installed, Adrozek makes multiple changes to the browser settings and components including the default homepage, adds new browser extensions, changes the in-browser DLL files, browser’s default search engine, updates schedule, permissions settings, and much more, in order to allow the malware to inject ads into search engine result pages. The malware uses various names like Audiolava.exe, QuickAudio.exe, and converter.exe.

This file in drops the main payload in the Program Files folder using a file name that makes it look like legitimate audio-related software. exe file with a random file name in the %temp% folder. Microsoft has described Adrozek’s attack chain in the image below:Īs can be seen in the image above, the installer from the domain drops a. Interestingly, some of the domains were distributing clean files like Process Explorer, which was likely an attempt by the attackers to improve the reputation of their domains and URLs and evade network-based protections. Some of the domains were up for just one day, while others were active for longer up to 120 days. The distribution infrastructure is also very dynamic. Attackers depended heavily on polymorphism, which allows them to churn huge volumes of samples as well as to evade detection. The Adrozek malware is installed on devices through a drive-by download.

Microsoft’s tracking of the Adrozek campaign from May to September 2020 saw 159 unique domains used to distribute hundreds of thousands of unique malware samples, each hosting an average of 17,300 unique URLs, which in turn host more than 15,300 unique, polymorphic malware samples on average.įrom May to September 2020, the Redmond tech giant recorded hundreds of thousands of encounters of the Adrozek malware across the globe, with a heavy concentration in Europe, South Asia, and Southeast Asia. Besides, the malware maintains persistence and exfiltrates website credentials, exposing affected devices to additional risks. According to the Microsoft Team, browser modification malware isn’t necessarily new or all that advanced, but the fact that this campaign utilizes a piece of malware that affects multiple browsers is an indication of how this threat type continues to be increasingly sophisticated.

Microsoft edge extensions injecting ads into