Loading story…
Researchers detailed how Win32/Theola abuses a malicious Google Chrome plugin to conduct banking fraud, using legitimate Chrome and NPAPI functionality to manipulate web sessions, intercept sensitive information, and evade common detection methods. The malware was identified as a component of the Win32/Mebroot.FX bootkit and communicates with other malware modules through named pipes, allowing it to coordinate credential theft without relying on more visible user-mode network hooks.
The plugin alters web form handling to expose password fields and capture submitted banking data, and it also includes video recording capability through the x264 library to monitor victim activity. Reported detections rose sharply in early 2013, with infections concentrated in countries including the Netherlands, Norway, Italy, Denmark, and the Czech Republic, indicating a targeted campaign aimed at online banking users.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
The article states that detections of Theola plugins increased from the end of January 2013. The Netherlands, Norway, Italy, Denmark, and the Czech Republic were among the most affected countries.
The Win32/Mebroot.FX bootkit family, of which Theola is described as a component, had been known since 2007.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported a surge in **malicious Chrome extensions** abusing high-privilege browser permissions to steal credentials and hijack authenticated sessions. LayerX identified at least **16 ChatGPT-related extensions** that mimic legitimate productivity tools and brands, then inject scripts into `chatgpt.com` to monitor outbound web requests and **exfiltrate authorization details and session tokens** to attacker-controlled infrastructure. With stolen tokens, attackers can impersonate victims’ ChatGPT sessions and potentially access connected data sources (e.g., integrations with *Slack* and *GitHub*), expanding impact beyond the AI service itself. Separately, Varonis documented a **malware-as-a-service** browser-extension toolkit dubbed **Stanley** being sold on Russian-language cybercrime forums, marketed to enable large-scale credential theft by **showing a phishing site while the URL bar continues to display the legitimate domain**. The toolkit uses a web-based control panel to configure per-victim “source” (legitimate) and “target” (phishing) URLs, then overlays a full-screen iframe to spoof the destination site; the seller also claims “guaranteed” placement in the **Chrome Web Store**, increasing the likelihood of user installation and enterprise exposure.
Jun 29, 2026
Researchers reported multiple malware delivery campaigns using **malicious email**, **fake browser updates**, and likely **content injection** on compromised websites to install infostealers and remote access trojans. One campaign abused WordPress sites to present a fake **Google Chrome** update that delivered credential-stealing malware, while another used malicious **PEC** email lures tied to crypto-wallet themes to infect targets with remote access tooling and theft-focused payloads. Separate reporting also described spam operations distributing evasive malware through email, showing continued reliance on social engineering and web-based lures to gain initial access. The activity aligns with attacker use of **MITRE ATT&CK** techniques including `T1659` for content injection and `T1555` for stealing credentials from password stores. Once installed, these malware families commonly target saved passwords and account data from browsers, email clients, FTP/SFTP tools, Wi-Fi profiles, and Windows credential stores using utilities and methods associated with tools such as **LaZagne**, **Mimikatz**, **MailPassView**, and **Network Password Recovery**. The campaigns underscore a persistent threat pattern in which adversaries combine deceptive delivery methods with credential theft to expand access, move laterally, and compromise additional systems.
Aug 11, 2026
The **Win32/Caphaw** banking trojan, also known as **Shylock**, targeted major European banks with a webinject plugin that altered online banking sessions in real time and enabled fraudulent transactions. Researchers said the malware had been active since at least 2011 and was especially prevalent in the **United Kingdom, Italy, Denmark, and Turkey**, with spread peaking in late 2012. Its webinjects could replace phone numbers shown on banking sites and use an **autoload** feature to initiate theft while victims were actively logged in, helping attackers bypass one-time-password protections. Caphaw combined several evasion and persistence techniques, including **process injection**, inter-process communication through **named pipes**, **anti-VM checks**, **polymorphic repacking**, and encrypted configuration delivery. The malware also supported a broad plugin ecosystem that expanded its capabilities beyond banking fraud, including **SOCKS proxying**, credential theft, **VNC** remote access, **Skype propagation**, removable-media spreading, video capture, and an **MBR bootkit** component tracked as **Win32/Wolcape**.
Aug 14, 2026