TLDR Tech / InfoSec
From a Sophisticated Browser-Extension Supply-Chain Compromise to a VibeCoded Twist: A Chrome Extension as the Initial Access Vector for a Broader Malware Chain
The Featured Chrome extension ShotBird (ID: gengfhhkjekmlejbhmmopegofnoifnjp) was weaponized after an ownership transfer between December 2025 and March 2026, transformed into a remote-controlled malware channel that beaconed to api.getextensionanalytics.top, stripped CSP/X-Frame-Options headers via declarative rules.json, injected fake Chrome update lures, and exfiltrated form data including passwords, card/CVV, IBAN, and SSN fields. The file-delivery path dropped googleupdate.exe (SHA256: E8D2ED43...), a WiX Burn bootstrapper bundling a legitimate Google-signed ChromeSetup.exe alongside a stager psfx.msi that decoded to irm orangewater00.com|iex. PowerShell Script Block Logging (Event ID 4104) reconstructed a second stage from 115 fragments, revealing ETW suppression via PSEtwLogProvider, Windows Credential Manager enumeration, Chromium Login Data and Web Data targeting, and exfiltration routines — with infrastructure and endpoint patterns overlapping a parallel campaign involving the QuickLens extension documented by Annex Security.
Read the full story