Researchers have identified malicious Firefox add-ons designed to steal sensitive user data, including cryptocurrency wallet seed phrases and browser credentials. The discovery highlights the ongoing risk that browser extensions pose, as users installing seemingly legitimate add-ons may inadvertently grant attackers access to critical financial and authentication information. This threat underscores the importance of scrutinizing browser extension sources and permissions before installation.
Threat actors are leveraging excitement around leaked GTA 6 content by hosting fraudulent "Play Now" sites that distribute an infostealer capable of harvesting stored browser credentials. Users visiting these deceptive pages risk compromise of their password managers and cached authentication data. The campaign demonstrates how high-profile leaks continue to serve as effective social engineering vectors for credential theft operations.
SynkLoader, an advanced multilingual malware family, employs screen hijacking techniques to steal passwords while offering a range of novel capabilities that position it as a potential precursor to ransomware deployment. The malware revives an older attack method—screen hijacking—to effectively compromise credentials while maintaining additional functional tools for follow-on attacks.
Threat actors are leveraging fake Codex download pages hosted on Google Sites to distribute macOS malware, using sponsored search results and ClickFix tactics to deceive users into compromising their systems. This campaign exploits legitimate Google infrastructure and trusted search visibility to establish credibility while redirecting Mac users to malicious payloads. The multi-stage attack chain combines infrastructure abuse with social engineering techniques to increase infection success rates.