HACKERS USING MALICIOUS WEB EXTENSIONS TO SPY ON USER EMAILS

Mon 01 August 2022:

A group of North Korean hackers is using a malicious Microsoft Edge or Chrome extension to track or access user email accounts.

According to cybersecurity company Volexity, the malicious extension created by the hacker collective known as “SharpTongue” is capable of stealing email content from AOL and Gmail.

According to a statement from the cybersecurity researchers, “This actor is believed to be North Korean in origin and is often publicly referred to under the name Kimsuky. The definition of which threat activity comprises Kimsuky is a matter of debate among threat intelligence analysts,”

SharpTongue is targeting and victimising individuals working for organisations in the United States, Europe and South Korea who work on topics involving North Korea, nuclear issues, weapons systems, and other matters of strategic interest to North Korea.

Within the last year, Volexity has responded to multiple incidents involving SharpTongue and, in most cases, has discovered a malicious Google Chrome or Microsoft Edge extension dubbed as ‘SHARPEXT’.

“Since its discovery, the extension has evolved and is currently at version 3.0, based on the internal versioning system. It supports three web browsers and theft of mail from both Gmail and AOL webmail,” the researchers informed.

The attack is concealed from the email provider by stealing email data while a user is already logged in, making detection very difficult.

In a similar manner, the extension’s functionality means that, even if a user were to review their email “account activity” status page, suspicious activity would not be recorded there, according to the cybersecurity firm.

SOURCE: INDEPENDENT PRESS AND NEWS AGENCIES

___________________________________________________________________________________________________________________________________________

FOLLOW INDEPENDENT PRESS:

TWITTER (CLICK HERE)
https://twitter.com/IpIndependent