Loading story…
Sansec reported an active keylogger running on the employee merchandise store of one of America’s largest banks, a site used by 200,000+ employees to purchase company-branded items. The malware was described as intercepting data entered into web forms—including login credentials, payment card numbers, and personal information—and remaining undetected by other security vendors at the time of reporting. Sansec warned that the impact could extend beyond the store itself because employees may reuse credentials, potentially enabling attackers to gain a foothold into internal banking systems; the research also notes employee stores and similar “peripheral” properties often fall outside normal audit scope and are attractive targets.
Sansec said notification and remediation were slowed because the bank did not publish an industry-standard security.txt file or other clear security reporting channel, forcing outreach via generic email addresses and LinkedIn while the attack continued. A separate report on malicious Chrome extensions impersonating Workday/NetSuite describes a different threat (browser-extension session hijacking and token/cookie theft) and does not appear connected to the bank keylogger incident beyond the general theme of credential theft.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Sansec publicly disclosed the incident and released technical details, indicators of compromise, and defensive guidance such as blocking malicious injections, monitoring client-side scripts, expanding audit scope, and publishing security.txt. A follow-up article framed the case as evidence of a broader enterprise reporting and response problem.
After discovering the compromise, Sansec said it notified the bank but had difficulty finding an appropriate reporting channel because the organization did not publish a security.txt file or a clear security contact. The delayed outreach highlighted how external incident reports can be lost in generic support workflows while malicious activity remains active.
In its analysis, Sansec said the infrastructure and code patterns overlapped with earlier getInjector web-skimming campaigns, including a previous incident affecting the Green Bay Packers. The company also published related domains and other indicators of compromise tied to the operation.
Sansec identified an active client-side keylogger on the employee merchandise store of one of the largest U.S. banks, a site used by more than 200,000 employees. The malware intercepted form data including login credentials, payment card numbers, and personal information, using a two-stage JavaScript loader and exfiltrating data to attacker-controlled infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a coordinated operation involving at least five **malicious Chrome extensions** masquerading as productivity or security tools, designed to **hijack enterprise web sessions** by stealing authentication cookies/session tokens. The extensions targeted business platforms such as **Workday, NetSuite, and SAP SuccessFactors**, where possession of a valid session token can enable access without re-entering credentials; telemetry indicated some variants attempted to **exfiltrate cookies as frequently as every 60 seconds**. Prior to takedown requests to Google, the campaign was estimated to have reached **2,300+ installs**. One variant, **Software Access**, was described as particularly advanced because it supported **bidirectional cookie injection**—using Chrome APIs such as `chrome.cookies.set()` to implant stolen session cookies into an attacker-controlled browser, effectively recreating an authenticated session. Investigators noted the extensions shared **identical infrastructure patterns** despite being published under different names (including multiple under “databycloud1104”), supporting attribution to a single coordinated actor. Recommended mitigations included stricter enterprise controls over browser extensions (vetting and limiting permissions, especially cookie access), removing unnecessary add-ons, and monitoring for anomalous session activity and extension behavior to detect session hijacking attempts earlier.
Jun 29, 2026
Security researchers reported multiple **malicious browser extension** operations abusing official add-on stores. Socket identified five Chrome Web Store extensions impersonating productivity/security tools for **Workday, NetSuite, and SAP SuccessFactors**, installed over 2,300 times, that performed credential theft and session abuse via **cookie exfiltration**, **cookie injection for session hijacking**, and **DOM manipulation** to block security/incident-response administration pages; the extensions appeared under different publisher names but shared code structure, targeting logic, and infrastructure, indicating coordinated activity. Separately, LayerX documented continued activity in the **GhostPoster** campaign across Chrome, Firefox, and Edge, adding 17 more extensions with a combined ~840,000 installs. The extensions concealed malicious JavaScript in image assets (e.g., logo files) to fetch an obfuscated payload that monitored browsing, planted a backdoor, hijacked affiliate links, and injected invisible iframes to drive **ad/click fraud**; LayerX assessed the operation likely originated in the Edge ecosystem and later expanded, with some extensions reportedly present since 2020, suggesting long-lived persistence despite prior public exposure by Koi Security.
Jun 29, 2026
Researchers reported that the **KeyBase** credential-stealing trojan continued to spread widely even after its public takedown, with attackers distributing it through phishing emails and Office exploit kits. The malware steals browser and email passwords, logs keystrokes and clipboard data, captures screenshots, and uploads stolen information to a web management panel known as **Keypanel**. Analysis of exposed infrastructure found **82 active panels across 64 websites**, **933 infected Windows systems**, and **125,083 screenshots**, showing that operators were still actively collecting data from victims. The exposed screenshots and panel data revealed heavy targeting in **India, China, South Korea, the United Arab Emirates, Indonesia, Bangladesh, and Djibouti**, with manufacturing, transportation, hospitality, education, and business operations among the affected sectors. Researchers linked campaigns to phishing lures such as purchase orders and aviation-themed messages, and found evidence that attackers used embedded Nirsoft tools including `MailPassView` and `WebBrowserPassView`, stored in AES-encrypted form and unpacked at runtime, alongside obfuscated strings and compromised email accounts. The stolen material included banking activity, cargo and purchase-order details, hotel guest information, educational records, and other data consistent with credential theft, invoice fraud, and supply-chain compromise.
Aug 15, 2026