Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
7 IOCs
Malicious Chrome Extensions Manipulate Google Organic Search Metrics
Excerpt
A coordinated network of 152 Chrome browser extensions has been caught manufacturing fake Google organic search traffic and secretly harvesting user data, all while falsely claiming on the Chrome Web Store that they collect no data whatsoever. Socket’s Threat Research Team uncovered the operation, which spans 38 separate Chrome Web Store publisher accounts and three brand backends: tabplugins[.]com, yowgames[.]com, and chromewallpaper[.]com. Disguised as “live…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Attack Flow7 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →7 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | chromewallpaper.com | High | Score 58/100 | First seen |
| Domain | yowgames.com | High | Score 58/100 | First seen |
| Domain | avads.live | High | Score 58/100 | First seen |
| Domain | owhit.com | High | Score 58/100 | First seen |
| IP | 92.112.198.22 | High | Score 58/100 | First seen |
| Domain | tabplugins.com | High | Score 58/100 | First seen |
| IP | 147.79.120.202 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…