Malware Alert: Rilide Extension Targets All Chromium-Based Browsers

In a recent discovery, security researchers from Trustwave SpiderLabs have uncovered a new strain of malware called Rilide that specifically targets users of all chromium-based browsers, including Google Chrome, Microsoft Edge, Brave Browser, and Opera. This malicious extension is disguised as a legitimate Google Drive extension, making it difficult for users to detect its true intentions.

Once installed, the Rilide extension is capable of collecting system information, exfiltrating browsing history, taking screenshots, and injecting malicious scripts. Its primary goal is to compromise email accounts, including Outlook, Yahoo, and Google, as well as cryptocurrency accounts, such as Kraken, Bitget, Coinbase, and more.

One of its tactics is to replace email confirmations on the fly if a user enters their mailbox using the same web browser. This includes replacing withdrawal request emails with device authorization requests, tricking users into providing the authorization code. While the withdrawal request is made in the background, the user is presented with a forged device authentication dialog to obtain 2FA.

According to security researchers Pawel Knapczyk and Wojciech Cieslak, Rilide's crypto exchange scripts support an automatic withdrawal function, making it even more dangerous for cryptocurrency users. It's essential for users of chromium-based browsers to be aware of this threat and take necessary precautions to protect their online accounts.

To avoid falling victim to the Rilide malware, users should only install extensions from trusted sources, regularly update their browser and operating system, and enable two-factor authentication (2FA) whenever possible. It's also crucial to monitor account activity closely and report any suspicious behavior to the relevant authorities immediately.

In conclusion, the discovery of Rilide highlights the importance of staying vigilant against malware threats targeting chromium-based browsers. By understanding how this malware operates and taking necessary precautions, users can protect their online accounts from potential harm.

All chromium based browsers