Microsoft exposes Adrozek, malware that hijacks Chrome, Edge, and Firefox

[ItsjustMe]

Microsoft says that at its peak, Adrozek had controlled more than 30,000 devices a day.

https://www.zdnet.com/article/microsoft-exposes-adrozek-malware-that-hijacks-chrome-edge-and-firefox/

Microsoft has raised the alarm today about a new malware strain that infects users' devices and then proceeds to modify browsers and their settings in order to inject ads into search results pages.

Named Adrozek, the malware has been active since at least May 2020 and reached its absolute peak in August this year when it controlled more than 30,000 browsers each day.

But in a report today, the Microsoft 365 Defender Research Team believes the number of infected users is much, much higher. Microsoft researchers said that between May and September 2020, they observed "hundreds of thousands" of Adrozek detections all over the globe.

Based on internal telemetry, the highest concentration of victims appears to be located in Europe, followed by South and Southeast Asia.

But if this wasn't bad enough, Microsoft says that on Firefox, Adrozek also contains a secondary feature that extracts credentials from the browser and uploads the data to the attacker's servers.

[msongs]

1. and what did microsoft do about it actually? says reinstall browsers but how does one know one

even has sit on one's computer

[Arne]

2. Glad I use Opera.

I also get this list by Email.

https://us-cert.cisa.gov/

[HubertHeaver]

3. Thanks for the link.

I just signed up.

[Eugene]

4. Opera is a Chromium-based browser like Chrome and Edge.

https://www.microsoft.com/security/blog/2020/12/10/widespread-malware-campaign-seeks-to-silently-inject-ads-into-search-results-affects-multiple-browsers/

Microsoft's posting states Adrozek works a malicious Chrome extension. Other reports name Chromium-based browsers (Google Chrome, MS Edge and Yandex) as 3 of the big 4 victims. The post implies but does not state a generic vulnerability.

A Google search shows reports of Opera-related incidents going back to September.

[Arne]

7. I'm not familiar with Yandex.

I've been keeping everybody updated with latest version, good or bad I haven't experienced
problems.
Keeping caches dumped and temps wiped allows me to browse very quickly even with old systems.

[hlthe2b]

5. Geez. Don't you get overwhelmed with alerts?

[Arne]

6. Yes but I learn a lot.

[CloudWatcher]

8. +1

Thanks for the link! I've subscribed