Loading story…
Telemetry and reverse engineering identified msclairty[.]com as a typosquatted domain impersonating Microsoft’s Clarity analytics service (msclarity[.]com / clarity[.]ms) and delivering an obfuscated in-browser ad-fraud payload. The JavaScript was observed being injected by a browser extension (not a compromised site script tag), with consistent behavior across multiple unrelated websites and affected users spanning multiple Chrome versions. Reported behaviors include deleting Google Analytics cookies, affiliate cookie stuffing (e.g., pub=twsc), injecting hidden iframes to discounthero[.]org, and Fetch API hijacking; the reporting also noted that common security tooling did not flag the domain at the time of publication.
Separate reporting described an XWorm malware wave using multi-stage JavaScript and PowerShell loaders that decode and execute payloads in memory, culminating in a DLL exporting ProcessHollowing to inject the XWorm client into the .NET compiler process. That activity included a C2 endpoint 204[.]10[.]160[.]190:7003, an aes_key value XAorWEAzx4+ic89KWd910w==, mutex Cqu1F0NxohroKG5U, and file hashes for the JavaScript, PowerShell loader, DLL, and final payload; however, this malware campaign is unrelated to the msclairty[.]com browser-based ad-fraud activity.
![Typosquatted msclairty[.]com Ad-Fraud JavaScript Injected via Browser Extension](/_next/image?url=https%3A%2F%2Fmallory-core-public-images.s3.us-east-2.amazonaws.com%2Ftyposquatted-msclairtycom-ad-fraud-javascript-injected-via-browser-extension.png&w=3840&q=75)
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
The reporting entity said it shared its findings with Microsoft for potential takedown and with RedTrack because the malicious script explicitly targeted RedTrack attribution cookies.
c/side published what it described as the first public documentation of msclairty[.]com, detailing the typosquatted infrastructure, browser-extension injection chain, cookie deletion, hidden iframe redirects to discounthero[.]org, and Fetch API hijacking.
Researchers observed the operation increase on March 3, affecting multiple unrelated industries while remaining limited to a small set of U.S. residential IPs and real Google Chrome on Windows 10.
Telemetry first recorded a coordinated Chrome-on-Windows campaign in which an unknown browser extension injected obfuscated JavaScript from msclairty[.]com. The activity used a staged loader and anti-analysis techniques while conducting affiliate fraud and suppressing competing tracking.
The domain msclairty[.]com, impersonating Microsoft Clarity, received its SSL certificate, suggesting the infrastructure was prepared specifically for the later campaign.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
cside.com
Open sourcecside.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that **ClickFix** has expanded into an industrialized malware-delivery ecosystem that relies on social engineering rather than software exploits. Attackers use fake CAPTCHA checks, browser updates, meeting errors, and verification prompts to trick users into manually running attacker-supplied commands through trusted tools such as PowerShell, `mshta`, `curl`, Windows Run, or macOS Terminal. ReversingLabs said the ecosystem now supports a wide range of payloads, including **Lumma Stealer**, **DarkGate**, **XWorm**, **AsyncRAT**, **NetSupport**, and **SectopRAT**, while related variants such as **CrashFix**, **FileFix**, **PromptFix**, and **ConsentFix** continue to emerge. The activity is being amplified through large-scale web compromise campaigns. Reports linked the **DriveSurge** actor to active **ClickFix** and **FakeUpdates** operations abusing thousands of compromised websites to distribute malware, while a separate SlowMist investigation documented a Google Sites-hosted phishing campaign targeting Web3 users on macOS with a fake community application flow that pushed victims to download a `.scpt` file or run a Base64-encoded Terminal command. That infection chain delivered a Mach-O stealer resembling **AMOS (Atomic macOS Stealer)**, which harvested browser credentials, cookies, Keychain data, Apple Notes, Telegram Desktop data, and cryptocurrency wallet files before archiving data to `/tmp/lksopo.zip` and exfiltrating it to `86.54.25.213`. Researchers said structural **YARA** detection of lure pages is currently one of the most effective ways to identify these campaigns, which often evade traditional AV and EDR controls because they depend on legitimate tools and user-approved execution.
Jul 18, 2026
Security researchers reported multiple **malicious browser extension** operations abusing official add-on stores. Socket identified five Chrome Web Store extensions impersonating productivity/security tools for **Workday, NetSuite, and SAP SuccessFactors**, installed over 2,300 times, that performed credential theft and session abuse via **cookie exfiltration**, **cookie injection for session hijacking**, and **DOM manipulation** to block security/incident-response administration pages; the extensions appeared under different publisher names but shared code structure, targeting logic, and infrastructure, indicating coordinated activity. Separately, LayerX documented continued activity in the **GhostPoster** campaign across Chrome, Firefox, and Edge, adding 17 more extensions with a combined ~840,000 installs. The extensions concealed malicious JavaScript in image assets (e.g., logo files) to fetch an obfuscated payload that monitored browsing, planted a backdoor, hijacked affiliate links, and injected invisible iframes to drive **ad/click fraud**; LayerX assessed the operation likely originated in the Edge ecosystem and later expanded, with some extensions reportedly present since 2020, suggesting long-lived persistence despite prior public exposure by Koi Security.
Jun 29, 2026
Microsoft Threat Intelligence disclosed that a malicious Chromium-based extension, **"Search for perplexity ai,"** impersonated Perplexity AI and was distributed through the Chrome Web Store before Google removed it. The extension used the typosquatted domain `perplexity-ai[.]online`, changed the browser’s default search provider, intercepted Omnibox queries and live search suggestions, and then forwarded users to legitimate search engines so the activity appeared normal. It also opened an onboarding page at `extension.tilda[.]ws/perplexityai` to reinforce the fake branding. Microsoft said the extension’s primary purpose was search interception and data collection rather than credential theft, although its permissions created significant privacy and security risk. By abusing Manifest V3 capabilities such as `chrome_settings_overrides` and `declarativeNetRequest`, the extension implemented a two-hop redirect chain that captured search terms, browser headers, user-agent strings, and source IP addresses through attacker-controlled infrastructure with server-side logging. Microsoft reported no definitive evidence of password theft, but said the collection of user browsing data was deliberate and covert.
Jul 12, 2026