Topic
Browser add-ons, often disguised as AI assistants or other useful tools, that steal data, hijack searches, or otherwise compromise users who install them.
Socket found 16 Firefox extensions posing as Rabby and OKX wallets that intercept recovery phrases and private keys during wallet import. Names and IDs rotated behind a screen that still read Rabby Wallet, so only an allowlist of exact extension IDs holds up.
Reality
CERT-UA says attackers planted fake Cloudflare checks on more than 100 legitimate websites to get visitors to install Lunex Stealer themselves. Ontinue says its browser components can keep file access after the stealer is deleted, so cleanup has to reach the browsers.
Perspective Coverage
3 publishersReality
EfficientIP put ten .cyou domains on its threat feed June 9, 23 days before they went live as redirects to a fake AliExpress site. The chain was designed to outrun reputation scoring, though its landing page had carried a phishing verdict since May 22.
Reality
Volexity attributes September 1 spear-phishing at multiple NGOs to the Chinese cluster UTA0560. The chain used two Chrome flaws and one in Windows ALPC, and a second China-nexus actor ran the same chain.
Reality
Hunt.io says a Chinese-speaking operator drove Claude Code, Alibaba Qwen and DeepSeek through an orchestration framework called SecFlow, splitting reconnaissance, exploitation and collection among specialist agents that fired only publicly documented exploits.
Reality
A year of Sophos managed detection cases shows the AI threat that actually landed was a lookalike download page. Claude appeared in 26 of 38 incidents.
Reality