LayerX Reveals 40+ Malicious Browser Extensions

🚨 Overview

DomainTools and LayerX collaborated to uncover over 40 malicious Chrome extensions that serve dual purposes:

• Masquerading as legitimate tools like VPNs, crypto tools, productivity apps
• Acting as phishing tools and persistent access points for attackers

🧪 Origin of Discovery

• DomainTools’ Threat Intelligence team detected malicious infrastructure via DNS and domain behavior analytics
• Initial detection occurred through suspicious domains like calendly-daily[.]com, aiwriter[.]expert, etc.
• Further analysis showed these domains were linked to browser extensions communicating with them regularly

📡 C2 Infrastructure & TTPs

• All extensions phone home to attacker-controlled domains
• Common TTPs (tactics, techniques, procedures) included:
  • Brand impersonation using cloned extension pages
  • AI-generated content for scalability
  • Consistent publisher email patterns (e.g. support@[domain])

🎭 Dual Function: Utility + Exploitation

These extensions offer seemingly useful functions like PDF converters, crypto trackers, or calendar apps — while simultaneously:

• Tracking keystrokes and clipboard data
• Capturing tokens/session data
• Redirecting users to phishing pages

🧠 LayerX Extension Analysis

LayerX investigated each browser extension by:

• Collecting extension IDs, names, publishers, and metadata
• Cross-referencing permissions and update timestamps
• Identifying overlapping infrastructure and branding

📋 List of Malicious Extension IDs

For the official source and future updates, visit: LayerX Security Blog