Browser Extensions

Subtechnique · ATTACK:enterprise:T1176.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1176.001",
  "title": "Browser Extensions",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1176/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--278716b1-61ce-4a74-8d17-891d0c494101",
  "external_id": "T1176.001",
  "domain": "enterprise",
  "created": "2025-03-30T22:12:27.799Z",
  "modified": "2025-09-22T17:00:42.545Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "persistence"
  ],
  "source_references": [
    {
      "source_name": "Pulsedive",
      "url": "https://blog.pulsedive.com/rilide-an-information-stealing-browser-extension/"
    },
    {
      "source_name": "Chrome Extension Crypto Miner",
      "url": "https://www.ghacks.net/2017/09/19/first-chrome-extension-with-javascript-crypto-miner-detected/"
    },
    {
      "source_name": "xorrior chrome extensions macOS",
      "url": "https://www.xorrior.com/No-Place-Like-Chrome/"
    },
    {
      "source_name": "Chrome Extensions Definition",
      "url": "https://developer.chrome.com/extensions"
    },
    {
      "source_name": "ICEBRG Chrome Extensions",
      "url": "https://www.icebrg.io/blog/malicious-chrome-extensions-enable-criminals-to-impact-over-half-a-million-users-and-global-businesses"
    },
    {
      "source_name": "Malicious Chrome Extension Numbers",
      "url": "https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/43824.pdf"
    },
    {
      "source_name": "Chrome Extension C2 Malware",
      "url": "https://web.archive.org/web/20240608001937/https://kjaer.io/extension-malware/"
    },
    {
      "source_name": "Catch All Chrome Extension",
      "url": "https://isc.sans.edu/forums/diary/CatchAll+Google+Chrome+Malicious+Extension+Steals+All+Posted+Data/22976/https:/threatpost.com/malicious-chrome-extension-steals-data-posted-to-any-website/128680/)"
    },
    {
      "source_name": "Banker Google Chrome Extension Steals Creds",
      "url": "https://isc.sans.edu/forums/diary/BankerGoogleChromeExtensiontargetingBrazil/22722/"
    },
    {
      "source_name": "Browser Adrozek",
      "url": "https://www.microsoft.com/en-us/security/blog/2020/12/10/widespread-malware-campaign-seeks-to-silently-inject-ads-into-search-results-affects-multiple-browsers/"
    },
    {
      "source_name": "Browers FriarFox",
      "url": "https://www.proofpoint.com/uk/blog/threat-insight/ta413-leverages-new-friarfox-browser-extension-target-gmail-accounts-global"
    },
    {
      "source_name": "Stantinko Botnet",
      "url": "https://www.welivesecurity.com/2017/07/20/stantinko-massive-adware-campaign-operating-covertly-since-2012/"
    },
    {
      "source_name": "Wikipedia Browser Extension",
      "url": "https://en.wikipedia.org/wiki/Browser_extension"
    }
  ]
}

Explicit source assertions (13)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.