New GhostPoster Attack Leverages PNG Icon to Infect 50,000 Firefox Users
A recently discovered malware campaign, identified as "GhostPoster," has compromised approximately 50,000 Firefox users through a sophisticated steganography technique.
A recently discovered malware campaign, identified as "GhostPoster," has compromised approximately 50,000 Firefox users through a sophisticated steganography technique.
The primary vector for this attack involves browser extensions, such as "Free VPN Forever," which conceal malicious payloads within their interface icons. GhostPoster embeds its initial execution logic directly into the raw bytes of a PNG file, effectively bypassing security scanners that typically treat image files as benign.
The infection process is activated when the compromised extension loads its logo.png file. The extension code reads the file's binary data, searching for a hidden marker sequence identified as 0x3D 0x3D 0x3D (== =). Upon detection, concealed JavaScript code is extracted, initiating a multi-stage infection chain.
This approach allows the malware to persist on the victim's browser, enabling operators to execute remote commands, strip security headers, and hijack user traffic without triggering alerts.
The primary vector for this attack involves browser extensions, such as "Free VPN Forever," which conceal malicious payloads within their interface icons.
Research indicates the campaign spans at least 17 extensions, all connecting to the same command-and-control infrastructure, such as liveupdt.com. The malware compromises user privacy by injecting tracking scripts and disabling critical browser protections, like Content-Security-Policy headers. This exposes users to additional risks, including cross-site scripting and clickjacking, while generating illicit revenue through forced redirects.
The extensions often remain dormant initially, using time-based triggers to avoid detection during installation.
GhostPoster's custom decoding routine unpacks the payload retrieved from its command-and-control servers. After the initial loader retrieves encrypted data, it undergoes a unique three-step transformation: swapping lowercase letters to uppercase and vice versa, exchanging the numbers '8' and '9', and performing a Base64 decode.
This obfuscation effectively evades static signature detection. The payload is further processed using XOR encryption derived from the extension's unique runtime ID, ensuring the decrypted code resides only in the browser's memory.
The malware introduces random delays and occasionally fetches the payload, complicating dynamic analysis for security teams attempting to replicate the infection.
Based on reporting by Cyber Security News.