Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The large-scale campaign has been codenamed VK Styles. The malware embedded in the extensions is designed to engage in active account manipulation by automatically subscribing users to the attacker's VK groups... manipulating Cross-Site Request Forgery (CSRF) tokens... and maintaining persistent control.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
"The extensions updated automatically and silently, meaning the attacker could push new malicious code with no user interaction required."
"marketed as a way to scrape Meta Business Suite data..."; "extensions masquerading as VK customization tools"; "advertised as artificial intelligence (AI) assistants"
"...active account manipulation by automatically subscribing users to the attacker's VK groups, resetting account settings every 30 days to override user preferences..."
"...active account manipulation by automatically subscribing users to the attacker's VK groups, resetting account settings every 30 days to override user preferences..."
"Present in the payload is obfuscated JavaScript that's injected into every VK page the victim visits."
"The extensions updated automatically and silently, meaning the attacker could push new malicious code with no user interaction required."
"Target Business Manager 'People' view ... and build a CSV file with names, email addresses, roles and permissions..."; "Enumerate Business Manager-level entities and their linked assets and build a CSV file..."
"...used VKontakte itself as part of the malware’s infrastructure, making the campaign harder to detect and block."
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.