browser-xpi-malware-scanner

I've been examining a few malware extensions on for Firefox and written articles about them. I've also made a scanner in python which helps with determining if it is malicious or not. * [Here is the scanner www.github.com/ernos/browser-xpi-malware-scanner](https://www.github.com/ernos/browser-xpi-malware-scanner) * [First malicious example - Credential-stealer, Remote command server control & breaking out of sandbox](https://www.yourdev.net/blog.php?post=extension-malware-in-t...) * [Second - Seems to be mostly about click affiliate fraud](https://www.yourdev.net/blog.php?post=supreme-adblocker-yout...) * [Third example + Guide for using the extension malware scanner](https://www.yourdev.net/blog.php?post=using-browser-xpi-exte...)

Trojans, malware, credential stealers etc are much more prevalent than people think. I have written a scanner in python that identifies most examples, all whom which pass for example firefox's validation process. This is an in depth article reverse engineering a malware sample (complete trojan with a command server controlling it) that is live on firefox's extension store. You can find the article here: https://www.yourdev.net/blog.php?post=extension-malware-in-t... and the scanner on my github here: https://www.github.com/ernos/browser-xpi-malware-scanner

This is a deep dive analysis of how to use browser-xpi-malware-scanner.py (https://github.com/ernos/browser-xpi-malware-scanner) to find live malware on the firefox extension store (or other browsers). I installed 10~ random extensions with low user count and found this pretty much right away using the scanner I've coded in python. Stenography seems to be the method of choice for threat actors wanting to write malware for browsers and bypassing the publication verification techniques.