ShotBird Extension Malware Report: Browser-to-Endpoint Compromise, Fake Update Delivery, and PowerShell Stager Reconstruction

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ShotBird Malware Campaign: Browser Extension Compromise and Host Malware Delivery The ShotBird campaign involves a supply-chain compromise of a Chrome extension, leading to malware delivery on user endpoints. Victims are primarily users of the affected browser extension, which delivered a PowerShell stager to facilitate further attacks. Technical details reveal the use of fake updates to propagate the malware. 3 sources 72