Crypto-Theft · CuraSec

tag: Crypto-Theft · 2 items

Engineer — Plan: Audit managed Chrome and Edge extension allowlists against the 19 identified malicious extensions (details in the Socket/Hacker News report); enforce an extension allowlisting policy to block unapproved installs in managed browser deployments.
SOC/IR — Plan: Pull endpoint telemetry to hunt for these extension IDs across managed devices; build or tune a detection for novel extension installations that request broad permissions aligned with credential or clipboard access.
Leader — Learn: A coordinated six-month extension campaign highlights browser add-ons as a persistent supply-chain risk; useful context for reviewing whether your browser governance policy enforces an approved extension allowlist.

Engineer — Plan: If your org uses Web3 tooling or allows browser extensions in managed environments, audit installed Firefox extensions against the 77 flagged add-ons (OKX, Rabby Wallet, TronLink impersonators) and enforce extension allowlisting via policy.
SOC/IR — Plan: Build or tune detections for browser extension installs from unofficial sources in managed endpoints; hunt for any of the 77 flagged extensions identified by Socket in your EDR extension inventory.
Leader — Skip