02/11/2025
Completed a hands-on lab analyzing a malicious browser extension. Below are the concise technical observations.
URL obfuscation: Base64 encoding.
Exfiltration vector: element (new Image() → src GET request`).
Sandbox/VM check (first trigger): navigator.plugins.length === 0.
Keystroke capture: document.addEventListener('keydown', ...) → event.key.
Encryption used: AES (CryptoJS.AES.encrypt) with IV; result base64-encoded.
Credential access: FormData API to read submitted username/email and password; uses window.location.hostname for context.
Takeaway
Simple but effective evasion and exfiltration techniques — great exercise in threat-hunting and chain-of-evidence extraction.
