Yaajde Feerorde bonnde, Hijackers Clipboard Crypto, e Reset Feerorde¶

Tesko-ɗen wonde adrees kaalis kripto (BTC, ETH, SOL, USDT) walla IBAN banke/limre routing nde ƴettu-ɗaa jooni ndee Ctrl+C (Cmd+C) wayliima e maagiyaŋkaagal wonti adres koɗo e oon sahaa mo toɓɓi-ɗaa Ctrl+V (Cmd+V), yiytude wonde ɓeydaare Chrome, Edge, Brave, walla Firefox nde njogi-ɗaa duuɓi jooni ("Waylugol PDF", "Ɓeydugol Volume", "Njiylawu Wideyoo", walla "Balloowo AI") yeeytaama e sirlu e senndikaa adware, jooni noon ina waɗa cookie jokkorɗe fenaande e mooftude jokkorɗe maa se walla coktirgal maa hijacked redirect page les mesaas "Feerorde maa ko njuɓɓudi maa toppitii ɗum" ko caɗeele joofnirɗe tiiɗɗe. Sabu feerorɗe web jamaanu ina njogii kuukiiji jokkondire maa kuutorteeɗe ngam Gmail, Microsoft 365, konsoleeji ruulde gollorɗe, njuɓɓudi konte, e kaalis Web3, ɓeydaare feerorde fenaande wootere rokkaama "Read and change all your data on all websites" (<all_urls> walla *://*/* yamiroore jaɓɓoowo) ina rewi e Hoolkiso Geɗe Keewɗe (MFA) timmuɗo e jaŋngude naatgol maa DOM, jokkorgal maa, e... navigator.clipboard buffer e sahaa goonga.

So tawii jokkere enɗam feerorde ndee ina yahdi e ƴaañgal, kulhuli ɓalli, walla ƴaañgol kaɓirɗe gollorɗe jokkuɗe, noddu limoore emergency nokku maa (911 to leyɗeele dentuɗe Amerik e Kanadaa, 112 e nder Dental Orop fof, 999 e nder leydi Angalteer) walla ƴeewto regginorde amen hakkunde leyɗeele limooje caɗtuɗe jonta. Ngam kala ko yowitii e ɓeydagol feerorde bonnde, malware clipper clipboard crypto, walla jokkorgal politik feerorde, huutoro golle ittugol forensik e ittugol jonnde les ɗoo.

Waɗde ɗum jooni¶

1. WOPPU jokkondirde e dokke teskinɗe (Ctrl+V / Cmd+V) e WOTO MEƊƊI jaɓde jokkondire kaalis kripto tawa hoolkisaaki alkule 6 gadane ɗee E 6 cakkitiiɗe ɗee e ekran kaalis maa hardware: Malware hijacker Clipboard ("Clippers" / CrypToClipper) huutortoo ko konnguɗi joopiiɗi ( ).RegEx) ngam yuurnitaade ordinateer maa e jokkorgal feerorde kala 100 milisekon. Ko ɗoon tan njiylotoɗaa a 0x... Adres Ethereum, bc1... Adres Bitcoin, walla adres Solana, ina wayla ko woni e nder tappirde ndee e adres lookalike vanity jeyaaɗo e jokkorgal ngal.
2. Sokkit ordinateer gonɗo e ñawu nguu e Wi-Fi / Ethernet hade maa udditeede chrome://extensions (edge://extensions / about:addons): Ekstensiyoŋaaji bonɗi keewɗi ina ƴeewa kuutortooɗo oo ina naata e tablo njuɓɓudi ekstensiyoŋaaji ɗii, tawa kadi ina uddita tablo ngoo, ina suuɗa koye mum en, walla ina waɗa dump exfiltration timmuɗo e kuukiiji maa jonnde udditiinde hade maa ɓuɗɗude Ittu. Mumtude Wi-Fi ko adii ina taƴa yamiroore-e-jokkondiral maɓɓe (C2) kanaal.
3. Mumtu "Sinkronisaasiyoŋ" e nder konte maa Google, Microsoft, walla Mozilla KO ADDI maa momtude ekstensiyoŋ fenaande: So Chrome Sync, Edge Sync, walla Firefox Sync ina softi, momtude ekstensiyoŋ bonɗo e nokku e ordinateer gooto ina heewi waasde sabu masiŋ maa ruulde walla masiŋ goɗɗo ina siynee hojomaaji 10 caggal ɗuum. Yah to chrome://settings/syncSetup/advanced (edge://settings/profiles/sync) e toggol Ekstensiyoŋaaji e OFF ko adii.
4. Winndu ID Yaajde 32 alkule (Developer Mode -> ID) e momtude ekstensiyoŋ oo E nokku mum IndexedDB / Local Extension Settings foldere ummoraade e disko: Ko adii nde ɓuɗɗu-ɗaa Ittu, uddit Mode Developer to dow-nyaamo chrome://extensions e winndude ID 32 alkule (yeru, aeblfdkhhhdcdjpifhhbdiojplfjncoa). Anndude oon ID tigi-rigi ena addana-ma hoolkisaade so tawii ɓeydaare ndee hollitaama ko malware e laaɓtinde foldere mum heddiinde ndee e nder nokku maa AppData / Library regginorde.
5. Laɓɓin kuule feerorde gollorɗe fenaande (chrome://policy be edge://policy) wiyde "Navigateur maa ko njuɓɓudi maa njuɓɓinta ɗum": E nder ordinateer galle neɗɗo, yiyde "Njuɓɓintaa ko njuɓɓudi maa" firti ko adware walla trojan winndi rogue ExtensionInstallForcelist walla SearchProvider coktirgal e nder binndital maa Windows (HKLM\SOFTWARE\Policies\Google\Chrome) walla Profaayiiluuji kuutorgal macOS (System Settings -> General -> Device Management) ngam a waawaa ɓuɗɗude butoŋ Ittu.
6. Softinde denndaangal kuukiiji jokkondire feerorde wujjaaɗe e ɓuɗɗude "Yaltu e jokkondire kala" e kaɓirgol laaɓngol: Sabu ekstensiyoŋ bonɗo e <all_urls> yamiroore walla chrome.cookies access ina jogori koppirde toɓɓe maa naatnugol e nguurndam, momtude tan ekstensiyoŋ oo waɗataa riiwtude ñaawoowo oo e konte maa. Huutoro smartphone laaɓɗo ngam doole Yaltu e denndaangal kaɓirɗe / Woppude joɗle winndereyankeewo e iimeel maa, banke maa, ruulde maa, e konte renndo maa, e waylude konte maa kuutorteeɗe rewrude e amen jaabawol ŋakkere dokke e doggol leaks password.

Lekki kuule : seerndude kulhuli ɓeydugol feerorde, ƴaañooɓe politik, e taƴooɓe OS¶

Rewru e ndeeɗoo nate ƴeewndo ngam anndude hol layer feerorde maa walla njuɓɓudi gollordu maa ŋakki e momtude feere duumiinde:

flowchart TD
    Start["Anomali feerorde yiytaa: Adres Clipboard waylaama, njiylawu waylaama, Popups Rogue, walla Session konte wujjaama"] --> Test{"1. Uddit Feerorde haa timma & Koppir/Paas Adres Kiripto e nder Notepad / TextEdit: Mbele ina wayla?"}
    Test -->|"Eey: Adres Mutates Yaasi Feerorde"| OSClip["MALWARE CLIPPER OS-LEVEL: Warde golle bonɗe e nder njuɓɓudi golle, laɓɓinde golle potɗe waɗeede / Dogde kuutorɗe & Dogde AV Scan mo alaa e laylaytol"]
    Test -->|"Alaa: Ko e nder Feerorde tan waɗata"| PolicyCheck{"2. Uddit chrome://politik walla edge://politik: Mbele Politik ina limtaa e ordinateer maa galle?"}
    PolicyCheck -->|"Eey: 'Ko njuɓɓudi maa njuɓɓini ɗum' / DoggolDooleEkstensiyoŋ"| WipePolicy["Mumtu kuutorɗe binnditagol Windows Rogue (kuule HKLM/HKCU) walla Ittu Profaayiil kuutorgal macOS"]
    PolicyCheck -->|"Alaa Poliisuuji tawaaɗi"| ExtAudit["3. Softinde Sinkronisaasiyoŋ -> Softinde Mode Developer e nder chrome://extensions -> Anndu & Ittu Ekstensiyoŋaaji bonɗi"]
    WipePolicy --> ExtAudit
    OSClip --> ExtAudit
    ExtAudit --> DiskWipe["4. Mumtu Dowlaaji Ekstensiyoŋ Keddiiɗi, Gollotooɓe Sarwiis & Kaɓirgal IndexedDB e nder Regginorde Profaayiil kuutortooɗo nokkuure"]
    DiskWipe --> CookieRevoke["5. Gila e Kaɓirgal Laaɓngal : Woppude Denndaangal Joɗle Kuuɓtodinɗe (Google, Microsoft, GitHub, Bankeeji) & Ƴeewto Jaɓɗe Kiripto"]

No ɓeydagol feerorde laawɗunde waylirta bonnde e nder jamma gooto (e sifaaji 5 njiyaagu)¶

Ko ɓuri 70 e nder teemedere e yimɓe wonduɓe e ɓeydagol feerorde bonnde meeɗaa ɓuuɓde e jokkorde lowre pirat : ɓe mbaɗii jokkorgal no woorunoo, toowngal, to bannge Chrome Web Store, Microsoft Edge Add-ons Store, walla Firefox Add-ons (AMO) lebbi walla duuɓi ko adii ɗuum. Siber-bonnooɓe ina mbonna ɓeydagol rewrude e laabi ɗiɗi : 1. Keɓgol / Ƴettugol kaalis (ɗo ƴaañoowo rokkata ƴellitoowo keeriiɗo $5,000 haa $50,000 kaalis ngam soodde jeyi ekstensiyoŋ kuutortooɗo 100 000, caggal ɗuum o pusnoo oto-update silsil ina waɗi malware obfuscated dow brows in'w); e 2. Developer OAuth Phishing (ɗo ƴaañooɓe njiylotoo konte ƴellitoowo Chrome Web Store tafɗo ekstensiyoŋ laawɗuɗo, hono no waɗirnoo e ŋakkeende mawnde e nder jokkondire jokkondire baɗɗe sappooji ekstensiyoŋaaji gollorɗe e kisal).

Daawe 1 : No ƴeewndorto-ɗaa, annditirtee, e laɓɓinirtee ɓeydagol bonngol ummoraade e Chrome, Edge, Brave, Firefox, e Safari¶

Hoto ƴeew tan e nate gonɗe sara bar adrees maa : ekstensiyoŋaaji bonɗi ina cuuɗii nate bar kuutorɗe mum en e anniya (Action butoŋ suuɗiiɗo) walla maskaade huutoraade nate e innde Google Docs Offline, Firo Google, Iwdi uBlock, walla Adobe Acrobat.

Ɗatal 1: Ƴeewto Ekstensiyoŋaaji maa ndarnaaɗi ɗii e nanngude ID 32-Karakteer¶

1. Seerndu ordinateer maa e Wi-Fi / Ethernet mbele hay ekstensiyoŋ gooto waawa neldude payload domen timmuɗo walla kesɗitingol hoore maa nde ƴeewndoto-ɗaa ɗum.
2. Uddit konsol njuɓɓudi ɓeydagol nder feerorde maa tawa aɗa winnda URI laaɓtuɗo e nder bar adrees:
3. Krom Guugl: chrome://extensions
4. Mikrosoft Edge: edge://extensions
5. Ferorde Jaambaaro: brave://extensions
6. Fayre Mozilla: about:addons (e kadi tappirde about:debugging#/runtime/this-firefox ngam yiyde ɓeydooje wakkati/suuɗɗe)
7. Safari appel (macOS): Safari -> Settings (Cmd + ,) -> Extensions
8. Uddit "Mode ƴellitoowo" (jokkondire to dow-nyaamo Chrome, Edge, e Brave).
9. Udditde Mode Developer ina hollita defte forensik teeŋtuɗe e kala kartal ɓeydaare:
10. ID: Ko jokkere enɗam keeriinde 32 alkulal (hono... cjpalhdlnbpafiamejdnhcphjbkeiagm).
11. Inspect views: service worker / background page: Hollitta so tawii ekstensiyoŋ oo ina huutoroo binndol caggal jooni.
12. Source: Installed by enterprise policy walla Loaded from: C:\Users\... (Unpacked Extension): So wonaa tawa ko a ƴellitoowo lowre winnduɗo lowre ndee e hoore maa, alaa lowre kuutortooɗo laawɗunde fotaani wiyde Loaded from: [Folder Path] (Ekstensiyoŋ mo pawaaka). Winndooɓe malware ina njuɓɓina ɓeydooje ɗe njuppaaka gila e suuɗnde AppData walla ProgramData foldereeji rewrude e waylude jokkorgal (chrome.exe --load-extension="C:\...") ngam woppude ƴeewndo kisal Chrome Web Store haa laaɓa cer.
13. Ƴeewto kala ɓeydaare e ɗeeɗoo Kuule Ittugol:
14. Ɓoɗɗu Detaayuuji -> Jaɓɗe (Site access) e kala ekstensiyoŋ gooto. Kala ɓeydaare jogiinde ** .On all sites (Read and change all your data on all websites)** mo wonaa kuutorgal kisal udditiingal, hoolkisaangal no feewi (hono njuɓɓudi konngol maa adanngol) ina foti ittude ɗoon e ɗoon, walla ko famɗi fof Naatgol lowre mum ina haɗee On all sites to On click.
15. Ɓoɗɗu Ittu e kala waylo-waylo PDF, VPN mo alaa kaalis, ƴettuɗo wideyoo/MP3, ɓeydoowo doole, kursorgel keeriiɗo, toggol mbaadi niɓɓo, njiylotooɗo kupon, jokkorgal bannge AI, walla ɓeydagol pijirlooji ɗi ngalaa haaju no feewi.

Ɗatal 2: Ƴeewto Extension's manifest.json e Trafik Reso Nguurɗo Ko adii Ittugol (Triage Forensique)¶

So aɗa yiɗi anndude so tawii ekstensiyoŋ tuumaaɗo wujjii tigi rigi konte kuutorteeɗe maa, kuukiiji jonnde maa, walla kuutorɗe kaalis kripto hade maa momtude ɗum, ƴettu hojomaaji ɗiɗi ngam ƴeewtaade piille mum iwdi nokkuure e disko tawa Wi-Fi maa ina jokkondiri haa jooni: 1. Koppir 32 alkulal ID hollirtee ko e kartal ɓeydaare e nder... chrome://extensions. 2. Naat e nokkuure feerorde maa Extensions foldere e disko (limtaande e alluwal e nder Ɗatal 4 les ngal) e udditde foldere nanndunde e oon ID 32-karakteer. 3. Uddit manifest.json fiilde nder ndeen doggol huutortoo Notepad Windows walla macOS TextEdit e ƴeewtaade fannuuji tati: - "permissions" be "host_permissions": Yiylo yamirooje toowɗe ina heen "cookies", "webRequest", "declarativeNetRequest", "clipboardRead", "clipboardWrite", "scripting", "debugger", "proxy", be "<all_urls>". Yaajde wiyde ko "Toggle Mode Dark" walla "Booster Volume" koolaaɗo ɗaɓɓoowo "cookies" be "<all_urls>" ko famɗi fof ko mooftude sessions login. - "content_scripts": Hollitta ko hol piille JavaScript (content.js, inject.js) ina njuutee e kala hello web ngo njillu-ɗaa, haa arti noon e portal bankeeji e portaabe kaalis kripto. - "background" ("service_worker"): Anndinde binndol caggal duumingol (background.js walla sw.js). Yiylaade oon fiilde JavaScript e nder Notepad ngam yiytude jokkondire hono fetch(, XMLHttpRequest, WebSocket, navigator.clipboard, chrome.cookies.getAll, eth_sendTransaction, walla atob( ina hollita yamiroore-e-jokkondiral (C2) domen e hollirde tigi rigi hol dokke ɗe njuɓɓinaa.

Ɗatal 3: Ƴeewto jokkorgal feerorde Target Hijacking (--load-extension)¶

Hay caggal nde ɓuuɓ-ɗaa Ittu e nder chrome://extensions, karallaagal trojan kuuɓtodinngal ina wayla jokkorgal desktop e jokkorgal gollorde ngal ɓuuɓ-ɗaa ngam udditde Chrome, Edge, walla Brave mbele ina loowa otomatikk jokkorgal bonngal suuɗngal ngal udditaaka kala nde uddit-ɗaa feerorde ndee. - E dow Windows: 1. Ɓoɗɗu e Google Chrome / Microsoft Edge / Brave maa to Desktop maa (e ɓuɗɗu e nate gonɗe e Barre Golle maa -> Ɓoɗɗu innde feerorde ndee kadi -> Ɓoɗɗu Sifaaaji). 2. Ƴeew Target: kaɓirgol les Tappude. 3. Box Target laaɓɗo ina joofna e tiiɗnaare e "chrome.exe" walla "msedge.exe": - LAAƁƊO: "C:\Program Files\Google\Chrome\Application\chrome.exe" - HIJKAA: "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\Public\Documents\ExtUpdater" https://search-hijack.com 4. Mumtu kala ko caggal chrome.exe" (walla momtu jokkorgal ngal fof e pinnude jokkorgal kesal to bannge C:\Program Files\Google\Chrome\Application\chrome.exe).

Ɗatal 4: Mumtu Fiildeeji Extension heddiiɗi e Gollotooɓe Sarwiis e Disk¶

Yiytu regginorde nate feerorde maa, momtu lowre ndee nanndunde e ID 32-karakteer ɓeydaare fenaande ndee, ɓeydu heen gollotooɓe sarwiis winnditiiɓe ɓee:

Caggal nde momtu-ɗaa foldere ɓeydaande ndee, udditaa chrome://serviceworker-internals (walla edge://serviceworker-internals) e nder feerorde maa e ɓuɗɗude Unregister e kala golloowo sarwiis jokkondirɗo e domenaaji push-notification ɗi nganndaaka.

Ɗatal 5: Laɓɓin jamirooje humpito Push Rogue, njiylawu njiylawu, e kuutorɗe Proxy / DNS bonɗe¶

Heewɓe e ekstensiyoŋaaji adware e hijackers feerorde ina ɗacca caggal mum en jolɗe tati ɗiɗmere hay so caggal nde binndol ekstensiyoŋ oo momtaa: 1. Woppu abonmaaji humpitooji Push Web bonɗi (Popups Antivirus fenaande): - So tawii jeertinaali fenaande McAfee, Norton, walla Windows Defender ina keddii e feeñde e ŋorol les-nyaamo ekran maa kala nde feerorde maa udditaa, ɗeen ko Notifikaaji Push Web HTML5 ummoraade e lowre fenaande nde ndokku-ɗaa yamiroore humpito tawa a anndaa. - Uddit chrome://settings/content/notifications (walla edge://settings/content/notifications / about:preferences#privacy -> Jaɓɗe -> Jeewte e nder Firefox). - Yillo les haa doggol "Aɓaa neldude humpitooji", ɓuɗɗu toɓɓe tati sara kala domen mo nganndu-ɗaa walla mo sikkaaka, ɓuɗɗu Ittu walla Haɗ. 2. Reset njiylawu gonɗo e njiylawu & kelle puɗɗagol: - Uddit chrome://settings/searchEngines (edge://settings/search) e hoolkisaade wonde njiylawu maa kuutorteeɗo oo ina toɗɗii Google goonga (google.com), DuckDuckGo, walla Bing wonaa URL njiylawu nannduɗo (search.yahoo.com/yhs/... walla find-results.net). Mumtu denndaangal njiylawuuji ɗi nganndaaka e nder doggol ngol. - Uddit chrome://settings/onStartup (edge://settings/onStartup) e ƴeewtaade "Uddit hello keeriiɗo walla denndaangal kelle": ittu kala URL puɗɗorɗo mo anndaaka mo adware oo naatiri. 3. Ƴeewto so tawii ko Proxy Siistem Hijacked walla DNS kisal (DoH) Cuɓe: - Won e ɓeydooje bonɗe e jolnooɓe adware ina kuutoroo binndol PAC (Proxy Auto-Config) nokkuure walla DNS-over-HTTPS (DoH) server ngam ɓe mbaawa jokkude haɓde e jolngo web maa caggal nde ekstensiyoŋ oo majji. - E nder Krom/Edge, yah to chrome://settings/security -> ƴeewto Kuutoro DNS kisal e hoolkisaade so tawii ko to jokkorgal maa jooni ngal walla to jokkorgal renndo hoolaare (Cloudflare 1.1.1.1, Quad9 9.9.9.9, walla Google Public DNS), wonaa URL keeriiɗo haawniinde. - Ndeen udditaa ** .chrome://settings/system** -> ɓuɗɗu Uddit dottaaɗe proxy ordinateer maa, e hoolkiso wonde "Kuutoro script setup" e "Kuutoro serveer proxy" fof ko OFF (so wonaa tawa ko golloowo maa yamiri ɗum).

Daawe 2: Ittugol "Njuɓɓudi maa njuɓɓudi" politikaaji gollorɗe fenaande (ExtensionInstallForcelist)¶

So tawii ko e ordinateer galle maa (wonaa laptop mo gollodiiɗo maa walla duɗal maa yaltini) tawa a waawaa ɓuɗɗude butoŋ Ittu e dow ekstensiyoŋ tuumaaɗo sabu ina waɗi nate mahdi birooji tokoosi sara mum, Chrome/Edge ina hollita **"Feeroorde maa ina jogori yuɓɓineede e nder fedde maa njuɓɓudi gollordu.

Ɗatal 1: Ƴeewtaade chrome://policy walla edge://policy¶

Winndu chrome://policy (walla edge://policy / about:policies e nder Firefox) e nder doggol adrees maa. - Yiylo inɗe politik hono ** .ExtensionInstallForcelist**, ExtensionInstallAllowlist, ExtensionSettings, HomepageLocation, RestoreOnStartupURLs, walla DefaultSearchProviderSearchURL. - Kolonel Nafoore gonɗo sara ExtensionInstallForcelist maa hollu ID Extension 32-alkule ekstensiyoŋ malware oo e URL keso mo o ƴettata oo.

Ɗatal 2: Laɓɓin kuule feerorde Rogue e Windows (Ɗaɓɓaande yamiroore toownde)¶

E nder galle neɗɗo Windows 10 walla Windows 11 PC mo fotaani fotde jogaade kala politik feerorde gollorde huutorteende, ɓuɗɗu e Menu Puɗɗorgal, winndu cmd, ɓuɗɗu e ñaamo Command Prompt, cuɓo-ɗaa Doggo no njuɓɓudi, e huutoraade ɗee yamiroore ngam momtude hives binnditagol kuule Chrome, Edge, e Brave bonɗe e hesɗitinde Kuule Goomu:

reg delete "HKLM\SOFTWARE\Policies\Google\Chrome" /f
reg delete "HKCU\SOFTWARE\Policies\Google\Chrome" /f
reg delete "HKLM\SOFTWARE\Policies\Google\Update" /f
reg delete "HKCU\SOFTWARE\Policies\Google\Update" /f
reg delete "HKLM\SOFTWARE\WOW6432Node\Google\Enrollment" /f
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Edge" /f
reg delete "HKCU\SOFTWARE\Policies\Microsoft\Edge" /f
reg delete "HKLM\SOFTWARE\Policies\BraveSoftware\Brave" /f
reg delete "HKCU\SOFTWARE\Policies\BraveSoftware\Brave" /f
rmdir /s /q "%WinDir%\System32\GroupPolicy"
rmdir /s /q "%WinDir%\System32\GroupPolicyUsers"
gpupdate /force

Caggal nde dogdu-ɗaa ɗeen jamirooje, ngartaa e ** .chrome://policy** (walla edge://policy) e ɓuɗɗu e butoŋ Reload policies to dow-nano. Denndaangal politikaaji gollorɗe doole maa majju ɗoon e ɗoon, e butoŋ Ittu e nder chrome://extensions maa uddit.

Ɗatal 3: Laɓɓin kuule feerorde Rogue & Profaayiiluuji konfiguraasiyoŋ e macOS¶

E nder macOS, ƴaañooɓe feerorde ina kuutoroo kuule gollorɗe fenaande kuutortooɗe laabi ɗiɗi : 1. Profaayiiluuji kuutorgal macOS (MDM profiles) wonde kuutortooɗo oo foolaama ngam sosde ɗum e sosde Flash/video player fenaande, e 2. Njuɓɓudi plist fiiluuji ɓurɗi yiɗeede.

1. Ƴeewto e ittude porofaayiiluuji kuutorgal macOS bonɗi:
2. Uddit Menu Apple -> Cuɓe Siistem -> Huuɓtodinnde -> Njuɓɓudi kaɓirɗe (e macOS ɓooyɗo Monterey/Big Sur, uddit Cuɓe Siistem -> Profaayiiluuji).
3. So aɗa woni e Mac keeriiɗo, njiy-ɗaa kala nate limtaaɗe e les Njuɓɓudi/Nate (ina heewi innireede "Ceŋorɗe Chrome", "SearchConfig", "AdminPrefs", walla "WeKnow"), suɓo-ɗaa ɗum, ɓuɗɗu e - (Ittu) butoŋ les, caggal ɗuum winndu password Mac maa ngam momtude ɗum.
4. Mumtu Feerorde Njuɓɓudi plist Fiildeeji rewrude e Terminaal macOS:
5. Uddit Terminaal (Cmd + Space, sifaa Terminal) e dogginde ɗeen jamirooje ngam ittude doole plist fiiluuji politik e laaɓtinde cfprefsd cache:

sudo rm -f /Library/Managed\ Preferences/com.google.Chrome.plist
sudo rm -f /Library/Managed\ Preferences/*/com.google.Chrome.plist
sudo rm -f /Library/Preferences/com.google.Chrome.plist
rm -f ~/Library/Preferences/com.google.Chrome.plist
sudo rm -f /Library/Managed\ Preferences/com.microsoft.Edge.plist
sudo rm -f /Library/Preferences/com.microsoft.Edge.plist
defaults delete com.google.Chrome ExtensionInstallForcelist 2>/dev/null
defaults delete com.google.Chrome HomepageLocation 2>/dev/null
sudo killall cfprefsd

Fuɗɗo Chrome/Edge kadi hoolkiso to chrome://policy wonde politikaaji zero ina keddii e golle.

Daawe 3 : Yiytude e momtude ƴaañooɓe ("Clippers") to bannge OS.¶

Hol ko woni so a ittii kala ekstensiyoŋ feerorde, udditii feerorde maa haa laaɓi, ƴeewtindo-ɗaa koppirde adrees wallet kripto (0x... walla bc1...) nder Windows Notepad walla macOS TextEdit, e adres mo jokkorgal ngal ina wayloo haa jooni e adres kaalis njulaagu?

Ɗum firti ko Binndi Clipper Malware to bannge Siistem gollorɗo (Laplas Clipper, ClipBanker, phemedrone, RedLine, walla binndol Python/Node/AutoIt fenaande) ina doga e caggal ordinateer maa ina nodda Windows AddClipboardFormatListener / SetClipboardData API (walla macOS NSPasteboard loop woote).

Ɗatal 1: Anndu Hol Golle Jooni Jogi walla Polls Clipboard maa¶

• E dow Windows (PowerShell e ƴeewndo fuɗɗoode): Uddit PowerShell no njuɓɓudi e dognude ndee yamiroore diagnostic ngam limtude denndaangal golle baɗɗe faayiida ɗe ngonaa Microsoft ɗe njoɓaaka e regginorde binndol kuutortooɗo (AppData, Temp, ProgramData, Users\Public) ɗo 99% e Trojans Clipper nguuri ɗoo :

Get-CimInstance Win32_Process | Where-Object {
    $_.ExecutablePath -match "AppData|Temp|ProgramData|Users\\Public"
} | Select-Object ProcessId, Name, ExecutablePath, CommandLine | Format-List

Ƴeewto yaltoore ndee so ina sikka .exe, pythonw.exe, wscript.exe, cscript.exe, powershell.exe, mshta.exe, walla AutoIt3.exe geɗe dogduɗe e %AppData%\Roaming, %LocalAppData%\Temp, walla C:\ProgramData. Tesko-ɗen ko... ProcessId (PID) e ExecutablePath, joofnu golle ɗee e Stop-Process -Id <PID> -Force, e momtude binndol ngol e disko.

• Ƴeewto nokkuuji tiiɗnaare Windows (Run Kuutorɗe & Scheduled Tasks): Clippers ina wuura e rebootuuji e ɓeydude Binnditagol Run key, ko fuɗɗoode .lnk fiilde nder shell:startup, walla Golle Ƴeewndorɗe. Doggo ɗeeɗoo ƴeewndorɗe ɗiɗi PowerShell ngam feeñninde ɗe:

Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run", "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
Get-ScheduledTask | Where-Object {$_.State -ne "Disabled" -and $_.Author -notmatch "Microsoft"} | Select-Object TaskName, TaskPath, State

Sosde Mikrosoft Siistem Otoruns (Autoruns64.exe) gila learn.microsoft.com/en-us/sysinternals/downloads/autoruns, dognu ɗum no Gardiiɗo, softina Cuɓe -> Cuɓe Skannde -> Hoolkiso siynooji kod + Ƴeewto VirusTotal.com, e momtu kala naatgol boɗewol/ngol siynaaka e nder Naatgol, Golle Ƴeewndorɗe, walla WMI.

• E nder macOS (Waɗooɓe udditgol e ƴeewndo golle caggal): Uddit Terminal ƴeewto denndaangal kuutortooɗo e system LaunchAgents be LaunchDaemons (ɗo macOS taƴooɓe e... Atomic Stealer / Poseidon binndi tiiɗnaare suuɗde):

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons
ps aux | grep -E "osascript|python|node|curl|base64|NSPasteboard"

Ƴeewto kala ko anndaaka .plist fiilde nder -/Library/LaunchAgents huutoraade cat -/Library/LaunchAgents/<filename>.plist, jippina ɗum e launchctl unload -/Library/LaunchAgents/<filename>.plist, e momtude ɗiɗo fof .plist e binndol ngol ngol toɗɗii.

Daawe 4 : Ɓooygol caggal ñawu nguu (woppude kuukiiji joɗnde wujjaaɗi, toɓɓe OAuth, e jaɓɗe Web3)¶

Mumtude jokkorgal feerorde bonnde ina haɗa ƴeewndo yeeso, kono ɗum bonnataa kuukiiji jonnde, konte kuutorteeɗe, walla konnguɗi aawdi wallet jokkorgal jolnaangal e serveer jokkorgal ngal nde ngal sosaa. Tesko-ɗen kala tablo ngo udditanoo e kala konngol kuutorteengol e nder njuɓɓudi konngol feerorde ndee ina ŋakki:

1. Doole "Yaltu e denndaangal jonɗe" e konte maa teeŋtuɗe:
2. Waylude tan konngol kuutorgol sahaa e sahaa fof ina addana toɓɓe OAuth goodɗe ɗee walla jokkondire mobiil/web ina mbaawi huutoreede haa waktu gooto. Naat e kaɓirgol laaɓngol, ɓuɗɗu e laaɓndal Yaltu e jokkondire ɗee kala / Woppu jokkondire ɗee kala:
   • Guugl / Gmail: myaccount.google.com/device-activity -> suɓo kala joɗnde nde nganndaaka walla desktop -> Yaltu. Kadi ƴeewto myaccount.google.com/permissions ngam ittude appliiji OAuth goɗɗi.
   • Mikrosof / Outlook / 365: account.live.com/proofs/manage/additional -> ɓuɗɗu Sign me out (doole yaltugol aduna e nder denndaangal feerorɗe e nder waktuuji 24).
   • GitHub / AWS / Konsoleeji duule: Yah to github.com/settings/sessions -> Wontin denndaangal joɗle, e waylude kala Toɓɓere Naatgol Neɗɗo (PATs) walla jokkorgal SSH.
   • Discord / Slack / Resooji renndo: Tesko-ɗen wonde ɓeydagol bonngol ina fawii e Discord's Local Storage toɓɓere hoolkiso e kuukiiji Gardiiɗo Njulaagu Facebook ; waylu konngol maa Discord (ngol rewnata toɓɓere kuutortooɗo maa Discord) e joofnude denndaangal joɗle kuutorteeɗe e nder Dottaaɗe Kisal Facebook/Instagram.
3. Eggude kala lowre kripto (MetaMask, Phantom, Rabby, Keplr) Ko ɗum ndartinaa e Feerorde Gooto:
4. So tawii ekstensiyoŋ bonɗo ina joginoo <all_urls> walla scripting access, walla so infostealer to bannge OS dogii e ordinateer maa, ina gasa tawa o janngii fiilngo maa sifirngo (ldb fiiluuji nder Local Extension Settings) e nanngude password udditirɗo wallet maa no mbinndir-ɗaa ɗum nii.
5. Woto **jogo kaalis e nder oon konngol aawdi wallet hot. Sos konngol aawdi kaalis keso e dow kaɓirgal laaɓngal walla kaalis Hardware (Ledger, Trezor, Keystone), nawtu jawdi maa heddii ndii e kaalis keso oo, e ittude jaɓɗe token dangling at revoke.cash rewrude e men kripto-kaalis wallet ɓuuɓɗo e aawdi konngol jokkere enɗam.
6. Waɗde Reset Feerorde timmunde:
7. Yah to chrome://settings/reset (edge://settings/reset / about:support -> Hesɗitin Firefox) e ɓuɗɗude Wartirde dottaaɗe ɗee e ngonka mum en. Ɗuum ina ustoo hello maa fuɗɗorde, hello tablo keso, njiylawu maa, e tablooji pinndaaɗi, ina momta kuukiiji wakkatiiji, ina softina kala ɓeydagol heddiingol.

Naamne keewɗe naamneede¶

Hol ko waɗi extension mo kuutortonoo-mi e kisal fotde duuɓi 2, ɗoon e ɗoon wayliima wonti malware walla adware?¶

Yaajde feerorde ndee ina hesɗitina otomatik e nder deeƴre tawa naamnaaki yamiroore maa so wonaa tawa mbaydi kesiri ndii ina ɗaɓɓi cate yamiroore kese. Pelle bonɗe e senndikaaji fenaande ad-fraud ina njokkondiri e sahaa kala e tafooɓe solo en ekstensiyoŋaaji ɓurɗi lollude, laawɗuɗi (hono kuutorɗe PDF, ɓeydooje volume, ƴettugol ekran, walla haɗooɓe ad) e rokkude ɓe ujunnaaje dolaar ngam yeeyde konte maɓɓe ƴellitooɓe Chrome Web Store walla waylude jeyi ekstensiyoŋ oo. So soodoowo oo jogorii jogaade limto ngoo, ɓe puɗɗotoo ko hesɗitinde mbaydi silkiindi tawa ina waɗi kode gujjugol cookiiji walla affiliate-hijacking ina safra kala kuutortooɗo gonɗo e nder jamma gooto.

Mbele kesɗitingol Manifest V3 Google ina addana Chrome e Edge kisal haa laaɓa e mborosaaji bonɗi ?¶

Alaa. So tawii Manifest V3 ina ɓeyda kisal no feewi e haɗde ekstensiyoŋaaji jolnude kode JavaScript kuutorteeɗe e woɗɗude ummoraade e serweeji yaajɗi (doole kodde kala ina njuɓɓinee e nder paaspoor ekstensiyoŋ mo jolnaa e nder defterdu), ekstensiyoŋaaji bonɗi mooftaaɗi e les form Manifest V3 ina mbaawi huutoraade haa jooni permission DOM alls e nder form e jokkorgal, ƴettude jokkorgal ngal rewrude e binndanɗe loowdi, wujjude kuukiiji, e huutoraade njeñtudi njiylawu rewrude e kuule declarativeNetRequest. Limtude ɓeydooje e ɓe ngoongɗin-ɗaa tan e waɗde yamiroore maɓɓe Naatde e Lowre ndee e "E dow ɓuuɓri" wonaa "E dow lowre ndee kala" ina heddii ko huunde himmunde.

Hol no mbaawirmi reende jolngo am kripto-kaalis e malware hijacker clipboard e ko fayi arde?¶

Ko adii fof, woto meeɗ hoolkisaade tan alkule 4 gadane ɗee e 4 cakkitiiɗe ɗee e adrees wallet paste, sibu malware clipper jamaanu oo huutortoo ko poolguuji adreesuuji vanity limtaaɗi ko adii ngam suɓaade adrees ƴaañoowo mo renndini alkule puɗɗorɗe e joofnirɗe goote e keɓoowo mo njiɗ-ɗaa heɓde oo ; sahaa kala ƴeewto ko famɗi fof alkule 6 gadane ɗee, 6 hakkundeeje ɗee, e alkule 6 cakkitiiɗe ɗee. Ɗiɗaɓere, huutoroo Wallet Hardware mo alaa e laylaytol tawa ina waɗi ekran ɓaleejo (hono Ledger, Trezor, walla GridPlus) e hoolkisaade adrees keɓoowo timmuɗo e ekran ɓaleejo kaɓirgal hardware hade maa toɓɓude butoŋ tabitinoowo ɓaleejo, e hisnude adreesuuji keɓoowo kuutorteeɗi keewɗi e nder wallet maa alluwal maa.

Fuɗɗoode ƴeewtaama¶

• Waɗde kisal siber e kisal gollorɗe (CISA, leyɗeele dentuɗe Amerik) & Biro Fedde Ngenndiije Dentuɗe (FBI): Wasiyaaji jokkondire kisal siber ko faati e malware Infostealer, ƴaañgol kuutorɗe session, e ɓeydagol feerorde bonnde.
• Duɗal ngenndiwal toppitiingal tolnooji e karallaagal (NIST, Dental Dowlaaji Amerik): SP 800-83 Rev. 1, Ƴeewndo ngam haɓaade e huutoraade geɗe bonɗe ngam ordinateeruuji e ordinateeruuji portaabe.
• Google Chrome & Goomu kisal Chromium: Doggol kuule Chrome (ExtensionInstallForcelist), Manifest V3 Arsitektuur Kisal Yaajde, e Feewnitde Injection Politique mo yamiraaka.
• Nokku jaabawol kisal Microsoft (MSRC) & Hakkille kulɓiniiɗo Microsoft Defender: Hiisaade e feewnude CrypToClipper / Hijacker Clipboard Malware e Rogue Navigateur Politik Binnditagol Duuɓi (HKLM\SOFTWARE\Policies\Microsoft\Edge).
• Nokku ngenndiijo kisal siber (NCSC, Leydi Angalteer): Ardingol kisal kaɓirɗe: Jokkondire e ɓeydagol feerorde, jokkondire hakkunde politik enterprise, e ustude gujjugol token.

Ardiiɓe jokkondirɓe¶

• Ɓooygol kaalis kripto, nanondiral konngol aawdi, e ittude jaɓɗe
• Ittugol mboros bonɗo, ransomware, e mboros spyware
• Fishing MFA, bypass gaño-e-hakkunde (AiTM), e gujjugol cookiiji jonnde
• Jaabawol ŋakkeende dokke, konte kuutorteeɗe, e ustude njoɓdi
• Limooje emergency e leydi