microsoft edge extensions injecting ads into

Microsoft says that they didn’t see the injected ads point to malicious sites, but that could easily change. The crooks behind this campaign are earning money through affiliate advertising programs, i.e., they are paid for traffic referred to sponsored affiliated pages.

As this campaign is ongoing, this infrastructure is bound to expand even further.”

“In our tracking of the Adrozek campaign from May to September 2020, we saw 159 unique domains used to distribute hundreds of thousands of unique malware samples. “Adrozek is installed on devices through drive-by download,” Microsoft explained. Modifying several systems settings to have even more control of the compromised device and maintain persistence.Modifying browser’s security settings/preferences to (for example) add permissions that enable the malicious extensions to have more control over Chrome APIs, or to prevent the browsers from being updated with the latest versions.Modifying specific DLLs (depending on the browser), to turn off security controls that might detect its actions.Modifying browser extensions by adding malicious scripts to them, which fetch additional scripts to injecting advertisements into search results.

And while the malware’s main goal is to inject ads and refer traffic to certain websites, the attack chain involves sophisticated behavior that allow attackers to gain a strong foothold on a device,” the Microsoft 365 Defender Research Team warned. “Adrozek shows that even threats that are not thought of as urgent or critical are increasingly becoming more complex. When searching for things online, has a greater number of ads than usual been popping up at the top of your search results? If it has, and you’re using Microsoft Edge, Google Chrome, Yandex Browser, or Mozilla Firefox, you might have fallen prey to the ad-injecting Adrozek malware.Īccording to Microsoft, cybercriminals have been pushing it on users since at least May 2020 and, at its peak in August, it was observed on over 30,000 devices every day.

Microsoft edge extensions injecting ads into