Attack of The Extensions

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

TL;DR: Browser extensions can turn Chromium into a persistent foothold. This post introduces a way to silently install extensions turning Chromium browsers into a command and control (C2) platform for persistent cookie theft.

Intro

This blog is a continuation of Dough No! Revisiting Cookie Theft. In the previous blog, we looked at how Chromium’s Application Bound Encryption (ABE) in Windows made cookie theft significantly harder. For operators, this meant they needed to inject into a browser process, utilize remote debugging, or install an extension to steal cookies. This blog post dives deeper into how to utilize extensions for more than just cookie theft. This time we’ll modify a browser’s profile settings to install a Mythic C2 agent called Ditto.

Similar to the previous blog, I’ll be referring to Edge and Chrome browsers as Chromium browsers.

The inspiration for this TTP came from asaurusrex's blog on silently installing Chromium extensions by just modifying the Secure Preferences file with a tool called Silent_Chrome, and from Michael Weber’s DEFCON33 talk called ChromeAlone. Michael’s talk highlighted the capabilities of Chromium browsers and how they can be leveraged into using the Chromium extension ecosystem as a C2. These talks led to the vibe-coded creation of SilentChrome-BOF: a Beacon object file (BOF) that installs extensions, Isolated Web Applications (IWA), and Native Messaging Hosts.

SilentChrome-BOF will be leveraged in this blog to highlight a browser-based persistence that leverages a new Mythic agent called Ditto. Ditto lives within a Chromium …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://specterops.io/blog/2026/08/13/chromium-extension-c2-persistence/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.