ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “firefox”

23 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 107Vulnerability 104Malware 24Ransomware 23Threat actor 9Data breach 8Phishing & fraud 2AI safety & security 2Industry 2Advisory 2Policy & legal 1
SeverityAllcritical 247high 23medium 13low 0info 1

Malicious Twitch Extension Exposes OAuth Tokens of 30,000 Chrome and Firefox Users

Malicious 'Twitch Enhanced Viewer | JeetBot' browser extension stole live OAuth session tokens from roughly 31,000 Chrome and Firefox users.

Socket.dev found the cross-store extension 'Twitch Enhanced Viewer | JeetBot' rerouted Twitch playlist requests through operator-controlled proxies, attaching the victim's account-level OAuth token as a URL parameter where it could be logged in cleartext. About 30,000 Chrome and 552 Firefox installs were exposed, with tokens forwarded for nearly every watched channel to infrastructure tied to a Russian commercial bot service. The stolen bearer token enables chat, whisper, account-setting access and channel-point spending without the password or 2FA.

Cyber Security Newsupdated · 2d agofirst · 2d agoMalware in the wild 2 sources

40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets

Socket found 40 malicious Firefox extensions impersonating OKX, Rabby Wallet, and TronLink to steal cryptocurrency wallet recovery phrases and private keys.

The Socket Threat Research team identified 40 malicious Firefox extensions masquerading as Web3 products including OKX, Rabby Wallet, and TronLink, part of a broader set of 77 add-ons sharing source code and infrastructure overlaps. The campaign, dubbed Offside Wallet Theft Factory, has been active since March 2026 and remains unattributed. Of the 40 confirmed malicious extensions, 15 capture recovery phrases and private keys exfiltrated through Cloudflare Workers, 13 modified Rabby Wallet builds exfiltrate serialized keyrings before local encryption, seven use attacker-controlled Supabase projects as remote switches, and five capture credentials and clipboard data via hard-coded C2. Some extensions began as sports score or utility shells before being repurposed into wallet stealers under the same Firefox ID.

The Hacker News · 27d agoMalware in the wild

Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users

Malicious Twitch extension 'Twitch Enhanced Viewer | JeetBot' leaked OAuth tokens from nearly 31,000 users to Russian bot-service proxy servers.

Socket researchers found the 'Twitch Enhanced Viewer | JeetBot' browser extension forwarded users' live Twitch OAuth tokens as an &auth= query parameter to operator-controlled proxy servers, affecting about 30,000 Chrome users and 604 Firefox users. The tokens, written in cleartext to proxy logs, are bearer credentials granting access to chat, whispers, and account settings without password or 2FA. The operator is a Russian commercial Twitch/Kick/VK-Live bot SaaS linked to Cyprus-based developer Aleksandr Popov; earlier v4.x builds also POSTed tokens to a set-token endpoint. Firefox add-on version 85.8.7 stops the token forwarding, but previously transmitted tokens remain valid until revoked.

The Hacker News · 3d agoMalware in the wild

HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures

A custom HVNC backdoor is targeting Latin American financial organizations via fake DocuSign and NFe tax-document lures, giving attackers hidden persistent remote access.

ANY.RUN researchers analyzed a multi-stage phishing campaign delivering a custom HVNC backdoor to banking and financial organizations in Latin America. The chain starts with fake DocuSign and NFe tax-document pages that serve per-visitor ZIP archives, followed by an LNK dropper, an NSIS loader, and a 64-bit backdoor masquerading as Windows Update Assistant. The implant provides hidden remote desktop control, keystroke monitoring, Firefox data theft, Startup-folder persistence, and EDR-aware behavior, communicating over TCP/27015.

ANY.RUN · 8d agoMalware in the wild

Twitch extension with 30K installs exposes users’ OAuth tokens

Twitch extension with 30,000+ installs exfiltrates users' OAuth session tokens to Russian-run JeetBot proxy servers.

Socket analysis shows the "Twitch Enhanced Viewer | JeetBot" browser extension, with over 30,000 installs on the official Chrome and Firefox stores, captures the Twitch web client's authorization header and extracts the user's OAuth token. The token is appended as an auth= URL parameter to video playlist requests routed through JeetBot proxy servers, landing in cleartext request logs retrievable by the Russian-language bot service vendor; ten hardcoded Russian-language channels are exempted. Earlier versions used more explicit token exfiltration, and the extension remained live in both stores at publication. Socket recommends removing the extension, disconnecting all Twitch sessions, and re-authenticating.

BleepingComputer · 2d agoMalware in the wild

Analysis of Smoke Loader in New Tsunami Campaign

Fake Japanese Meteorological Agency tsunami warning emails delivered Smoke Loader and AzoRult malware to steal credentials from targets in Japan.

A fake tsunami warning email impersonating Japan's Meteorological Agency asked recipients to click a link on a registered fake agency domain, delivering the commodity loader Smoke Loader to targets in Japan. Smoke Loader, active since 2011, is modular, and its payloads have included banking trojans, ransomware, cryptominers, password stealers, and PoS malware; the campaign later also deployed AzoRult. New samples add junk-jump obfuscation, encrypted network traffic and payload files, a unique machine ID used for tracking and encryption, and PROPagate injection into explorer.exe, with persistence via a Startup folder shortcut and RC4-encrypted C2 communication.

Palo Alto Unit 42 · Aug 17, 2026Malware in the wild

VectraRAT Malware-as-a-Service Lets Hackers Bypass UAC and Hijack Windows Systems

New VectraRAT malware-as-a-service at $250/month combines RAT capabilities, credential theft, clipboard hijacking, and a UACME-based UAC bypass; 38 victims observed.

VectraRAT is a previously undocumented MaaS platform with a Go-based VectraHub Linux C2 server embedding a Vue3 operator panel and a C++ Windows implant, rented from $250/month and linked to the aliases Vectra and Nyxel. It communicates over TCP port 3308 via a proprietary MessagePack protocol, steals browser and file-based credentials, and abuses UACME method 41 with debug-object handle hijacking via winver.exe and computerdefaults.exe. SOCRadar identified 38 live victim sessions in one week, 48% on corporate Windows editions, with delivery via the Amadey loader and ClickFix pages impersonating TurboTax.

GBHackersupdated · 16h agofirst · 18h agoMalware in the wild 3 sources

Hackers hijack HBO Max Reddit account to push malware in ClickFix ads

Hackers hijacked HBO Max's verified Reddit account to run 108 ClickFix ads delivering infostealers and crypto clippers to Windows and macOS users.

Hudson Rock and ADAMnetworks linked the hijacked u/hbomax Reddit account to a campaign they call PasteSwitch, which ran 108 malicious ads over roughly 48 hours pushing sites like hbomaxx.us, codex-craft.com, and code-desktop.com. ClickFix social engineering tricks victims into pasting Base64-obfuscated shell or PowerShell commands into Terminal or Run, delivering MacSync, AMOS helper persistence, Amatera Stealer loaded in-memory, and the AnimateClipper and ZigClipper crypto clipboard hijackers. Windows chains used an MP3/HTA polyglot to create scheduled tasks, disable AMSI, and launch 32-bit PowerShell; fake Ledger, Trezor Suite, and Exodus wallet apps steal recovery phrases. Reddit admins paused the ads, and it remains unclear how the account was accessed.

BleepingComputerupdated · 1d agofirst · 2d agoMalware in the wild 7 sources