Mgbakwunye ihe nchọgharị ọjọọ, ndị na-eme ihe nleba anya Crypto, na nrụpụta ihe nchọgharị¶

N'ịchọpụta na adreesị akpa ego cryptocurrency (BTC, ETH, SOL, USDT) ma ọ bụ nọmba ụlọ akụ IBAN/routing nke i jiri depụtaghachi ya Ctrl+C (Cmd+C) gbanwere n'ụzọ anwansi ka ọ bụrụ adreesị onye ọbịbịa ozugbo ị pịara Ctrl+V (Cmd+V), ịchọpụta na Chrome, Edge, Brave, ma ọ bụ Firefox ndọtị ị rụnyere afọ gara aga ("PDF Converter", "Booster Booster", "Video Downloader", ma ọ bụ "AI Assistant") ka erere ya na nzuzo na ụlọ ọrụ adware ma ugbu a na-agbanye njikọ ndị mmekọ rogue ma na-ewe kuki oge gị, ma ọ bụ ịchọta ihe nchọta nke ndabara gị akpọchiri na ibe redirect nke ihe nchọgharị gị na-achịkwa n'okpuru ozi a** ihe mberede. N'ihi na ihe nchọgharị weebụ ọgbara ọhụrụ na-ejide kuki nnọkọ gị na-arụsi ọrụ ike maka Gmail, Microsoft 365, njikwa igwe ojii, ndị njikwa okwuntughe, na obere akpa Web3, enyere otu ndọtị ihe nchọgharị rogue. "Read and change all your data on all websites" (<all_urls> ma ọ bụ *://*/* ikike nnabata) na-agafe nyocha Multi-Factor (MFA) kpamkpam site n'ịgụ ntinye DOM gị, mkpịsị igodo, na navigator.clipboard buffer na ozugbo.

Ọ bụrụ na ihe nchọgharị ahụ jikọtara ya na ịpụnara mmadụ n'ọrụ, iyi egwu anụ ahụ, ma ọ bụ waya ụlọ ọrụ na-aga n'ihu, kpọọ nọmba mberede mpaghara gị (911 na United States na Canada, 112 gburugburu European Union, 999 na United Kingdom) ma ọ bụ lelee akwụkwọ ndekọ aha anyị nke mba ụwa nọmba mberede ozugbo. Maka ikpe niile nke ndọtị ihe nchọgharị ọjọọ, crypto clipboard clipper malware, ma ọ bụ ijipu amụma ihe nchọgharị, mebie mwepụ nke nyocha na mwepu oge na-arụ ọrụ n'okpuru.

Mee nke a ugbu a¶

1. ** Kwụsị ịfefe data nwere mmetụta (Ctrl+V / Cmd+V) na anabatala azụmahịa cryptocurrency na-enyochaghị mkpụrụedemede 6 na nke ikpeazụ na ihuenyo obere akpa gị **: Clipboard hijacker malware ("Clippers" / CrypToClipper) na-eji okwu mgbe nile (RegEx) iji nyochaa sistemụ arụmọrụ gị na bọọdụ ihe nchọgharị gị kwa 100 millise seconds. Ozugbo ị na-eṅomi a 0x... Adreesị Ethereum, bc1... Adreesị Bitcoin, ma ọ bụ adreesị Solana, ọ na-eji adreesị yiri ihe efu nwere nke onye mwakpo nwere.
2. ** Kwụpụ kọmputa bu ọrịa na Wi-Fi / Ethernet tupu imeghe chrome://extensions (edge://extensions / about:addons***: Ọtụtụ ihe ndọtị obi ọjọọ na-elele onye ọrụ na-agagharị na taabụ njikwa ndọtị wee mechie taabụ ahụ na-akpaghị aka, zoo onwe ha, ma ọ bụ mee mkpochapụ ikpeazụ nke kuki nnọkọ mepere emepe tupu ị pịa ** Wepụ ***. Ịgbanyụ Wi-Fi na-ebu ụzọ bepụ iwu na njikwa ha (C2) ọwa.
3. ** Gbanyụọ "mmekọrịta Extensions" na akaụntụ Google gị, Microsoft ma ọ bụ Mozilla tupu ihichapụ ndọtị rogue ***: Ọ bụrụ na agbanyere mmekọrịta Chrome, Edge Sync, ma ọ bụ mmekọrịta Firefox, ihichapụ ndọtị ọjọọ na mpaghara n'otu laptọọpụ na-adakarị n'ihi na profaịlụ ígwé ojii gị ma ọ bụ desktọpụ ọzọ abanyela na-atụgharịghachi ndọtị ahụ laghachi na igwe gị nkeji oge gachara. Gaa na chrome://settings/syncSetup/advanced (edge://settings/profiles/sync) wee tụgharịa ** Extensions *** ka ** Gbanyụọ *** mbụ.
4. ** Dekọọ ID ndọtị nke mkpụrụedemede 32 (Developer Mode -> ID) ma hichapụ ndọtị NA mpaghara ya IndexedDB / Local Extension Settings nchekwa site na diski ***: Tupu ịpị ** Wepụ ***, gbanye ** Ọnọdụ onye nrụpụta ** n'akụkụ aka nri elu. chrome://extensions ma dee ID nke akwụkwọ ozi 32 (dịka ọmụmaatụ, aeblfdkhhhdcdjpifhhbdiojplfjncoa). Ịmara kpọmkwem ID ahụ na-enye gị ohere ikwenye ma agbanyere ndọtị ahụ dị ka malware wee hichapụ folda ya fọdụrụ n'ime mpaghara gị AppData / Library ndekọ.
5. Hichapụ ụkpụrụ ihe nchọgharị ụlọ ọrụ adịgboroja (chrome://policy na edge://policy) nke na-ekwu "Ndị otu gị na-ahụ maka ihe nchọgharị gị": Na kọmpụta ụlọ nkeonwe, ịhụ "Ndị otu gị na-elekọta" pụtara adware ma ọ bụ trojan dere rogue. ExtensionInstallForcelist ma ọ bụ SearchProvider igodo n'ime ndekọ Windows gị (HKLM\SOFTWARE\Policies\Google\Chrome) ma ọ bụ profaịlụ nhazi macOS (System Settings -> General -> Device Management) yabụ ị nweghị ike pịa bọtịnụ Wepu.
6. ** Wepụ kuki nnọkọ ihe nchọgharị zuru ezu site na ịpị "Si na ngwaọrụ dị ọcha pụọ": N'ihi na ndọtị obi ọjọọ nwere <all_urls> ikike ma ọ bụ chrome.cookies ohere ebipụtalarị akara nbanye gị dị ndụ, naanị ihichapụ ndọtị ahụ anaghị achụpụ onye mwakpo ahụ na akaụntụ gị. Jiri ekwentị dị ọcha manye zuru ụwa ọnụ ** Banye na ngwaọrụ niile / kagbuo nnọkọ ** na email gị, ụlọ akụ, igwe ojii na akaụntụ ọha, wee tụgharịa okwuntughe gị na-esochi anyị. Nzaghachi data mmebi data na okwuntughe nduhie.

Osisi mkpebi: ikewapụ ihe iyi egwu ndọtị ihe nchọgharị, ndị na-apụnara mmadụ iwu na ndị na-egbutu OS¶

Soro eserese nyocha a ka ịmata nke oyi akwa nke ihe nchọgharị gị ma ọ bụ sistemụ arụmọrụ mebie wee kpochapụ usoro nkwụsi ike:

flowchart TD
    Start["Achọpụtara Anomaly Ihe Nchọgharị: Agbanwera Adreesị Klipbọọdụ, Bugharịa Ọchụchọ, Popups Rogue, ma ọ bụ Ezuru Oge Akaụntụ"] --> Test{"1. Mechie ihe nchọgharị kpamkpam & detuo / mado adreesị Crypto na Notepad / TextEdit: Ọ na-agbanwe?"}
    Test -->|"Ee: Adreesị na-agbanwe n'èzí ihe nchọgharị"| OSClip["OS-LEVEL CLIPPER MALWARE: Gbuo usoro Rogue na onye njikwa ọrụ, hichapụ ọrụ akwadoro / Gbaa igodo & Gbaa nyocha AV na-anọghị n'ịntanetị."]
    Test -->|"Mba: Naanị n'ime ihe nchọgharị na-eme"| PolicyCheck{"2. Mepee chrome: // amụma ma ọ bụ ihu: // amụma: Edepụtara amụma na PC ụlọ gị?"}
    PolicyCheck -->|"Ee: 'Ndị otu gị jisiri ike' / ExtensionInstallForcelist"| WipePolicy["Hichapụ igodo amụma ndekọ Windows Rogue (Atụmatụ HKLM/HKCU) ma ọ bụ wepu profaịlụ nhazi macOS"]
    PolicyCheck -->|"Enweghị amụma ahụrụ"| ExtAudit["3. Gbanyụọ mmekọrịta -> Kwado ọnọdụ onye nrụpụta na chrome://extensions -> Chọpụta & Wepu ndọtị obi ọjọọ"]
    WipePolicy --> ExtAudit
    OSClip --> ExtAudit
    ExtAudit --> DiskWipe["4. Hichapụ folda ndọtị fọdụrụ, ndị ọrụ ọrụ & cache IndexedDB sitere na ndekọ profaịlụ onye ọrụ mpaghara"]
    DiskWipe --> CookieRevoke["5. Site na Ngwaọrụ dị ọcha: Wepụ oge niile na-arụ ọrụ (Google, Microsoft, GitHub, Banks) & Lelee nkwenye Crypto"]

Kedu ka ndọtị ihe nchọgharị ziri ezi si atụgharị obi n'abali (na ụdị ọgụ 5)¶

Ihe karịrị pasenti 70 nke ndị ihe ndọtị ihe nchọgharị ọjọọ butere emetụtaghị njikọ sọftụwia na-enyo enyo: ha wụnyere ndọtị kwesịrị ekwesị na nke ukwuu site na ụlọ ahịa ebe nrụọrụ weebụ ** Chrome, ** Microsoft Edge Add-ons Store**, ma ọ bụ Firefox Add-ons.AMO* ọnwa ma ọ bụ afọ gara aga. Ndị omempụ cyber na-emebi ndọtị site na ụzọ abụọ-ịnye ihe: 1. Nnweta ndọtị / Monetization Takeovers (ebe onye na-awakpo na-enye onye nrụpụta nọọrọ onwe ya $5,000 ruo $50,000 ego iji zụta nwe nke ndọtị 100,000 na-ewu ewu, wee kpalite mmelite akpaaka dị jụụ nke nwere malware na-emebi emebi nke ihe nchọgharị onye ọrụ ọ bụla dị na-ebudata na-akpaghị aka na ndabere); na 2. Onye nrụpụta OAuth Phishing (ebe ndị na-awakpo na-ezipụ akaụntụ onye nrụpụta ụlọ ahịa Weebụ Chrome nke ọma, dị ka mere n'ime nnukwu ndabi ụgbụọ ọkọnọ na-emetụta ọtụtụ ụlọ ọrụ yana mgbakwunye nchekwa).

Nkeji 1: Otu esi eleba anya, chọpụta na kpochapụ ndọtị ọjọọ sitere na Chrome, Edge, Brave, Firefox, na Safari¶

Elelela naanị akara ngosi dị n'akụkụ ogwe adreesị gị: ndọtị obi ọjọọ na-ama ụma zoo akara ngosi ngwaọrụ ha (Action bọtịnụ zoro ezo) ma ọ bụ masquerade site na iji akara ngosi na aha Google Docs Offline, Google Translate, uBlock Origin, ma ọ bụ Adobe Acrobat.

Kwụpụ 1: Nyochaa ndọtị arụnyere gị wee weghara NJ 32-agwa¶

1. ** Kwụpụ kọmputa gị na Wi-Fi / Ethernet *** ka ọ nweghị ndọtị nwere ike ibunye ụgwọ data ikpeazụ ma ọ bụ nwelite onwe gị mgbe ị na-enyocha ya.
2. Mepee njikwa njikwa ndọtị ihe nchọgharị gị site na ịpị kpọmkwem URI n'ime ogwe adreesị:
3. *Google Chrome: chrome://extensions
4. ** Microsoft Edge: edge://extensions
5. ** Ihe Nchọgharị Obi Ike ***: brave://extensions
6. **Mozilla Firefox ***: about:addons (nakwa pịnye about:debugging#/runtime/this-firefox ịhụ mgbakwunye nwa oge/zoro ezo)
7. Apple Safari (macOS) ***: Safari -> Settings (Cmd + ,) -> Extensions
8. ** Gbanwuo "Ụdị onye nrụpụta"** (ngbanwe mgbanwe na akuku aka nri nke Chrome, Edge na Brave).
9. Ịgbanwuo **Ụdị onye nrụpụta *** na-ekpughe nkọwa nyocha dị oke mkpa na kaadị ndọtị ọ bụla:
10. ID: eriri obere mkpụrụedemede nwere mkpụrụedemede 32 pụrụ iche (dịka cjpalhdlnbpafiamejdnhcphjbkeiagm).
11. Inspect views: service worker / background page: Na-egosi ma ndọtị ahụ na-arụsi ọrụ ike na edemede ndabere ugbu a.
12. Source: Installed by enterprise policy ma ọ bụ Loaded from: C:\Users\... (Unpacked Extension): Ọ gwụla ma ị bụ onye nrụpụta sọftụwia dere ndọtị ahụ n'onwe gị, ** enweghị ndọtị ndị ahịa ziri ezi ekwesịghị ikwu. Loaded from: [Folder Path] (Mgbatị na-enweghị ngwugwu). Ndị ode akwụkwọ malware na-ebufe ihe ndọtị ndị ezoro ezo AppData ma ọ bụ ProgramData folda site na mgbanwe ụzọ mkpirisi (chrome.exe --load-extension="C:\...") ịgafe nyocha nchekwa nchekwa Weebụ Chrome kpamkpam.
13. ** Lelee ndọtị ọ bụla megide ụkpụrụ mwepụ ndị a ***:
14. Pịa ** nkọwa -> ikike (Site access*** na ndọtị ọ bụla. Mgbatị ọ bụla nwere On all sites (Read and change all your data on all websites* nke na-abụghị ngwa ntụkwasị obi nke ukwuu, nke a ga-egosipụta nke ọma na-emeghe ihe nchekwa (dị ka njikwa okwuntughe gị) kwesịrị iwepụ ozugbo, ma ọ bụ opekempe, amachibidoro ịnweta saịtị ** ya. On all sites na On click .
15. Pịa ** Wepụ *** na ihe ntụgharị PDF ọ bụla, VPN efu, ihe nbudata vidiyo / MP3, ihe na-ebuli elu, cursor omenala, mgbanwe ọnọdụ gbara ọchịchịrị, ihe nchọta coupon, akụkụ AI, ma ọ bụ ndọtị egwuregwu ị chọghị.

Nzọụkwụ 2: Lelee Extension's manifest.json yana okporo ụzọ netwọkụ dị ndụ tupu mwepụ (ntụgharị akwụkwọ nyocha)¶

Ọ bụrụ na ịchọrọ ịma ma ndọtị a na-enyo enyo zuru okwuntughe ụlọ ọrụ gị, kuki nnọkọ, ma ọ bụ igodo cryptocurrency tupu ihichapụ ya, were nkeji abụọ iji nyochaa faịlụ mpaghara ya na diski mgbe Wi-Fi gị ka na-akwụsị. 1. Detuo mkpụrụedemede 32 ID egosiri na kaadị ndọtị n'ime chrome://extensions. 2. Gaa na mpaghara ihe nchọgharị gị Extensions nchekwa na diski (e depụtara na tebụl dị na Nzọụkwụ 4 n'okpuru) wee mepee folda dabara na NJ njirimara 32 ahụ. 3. Mepee manifest.json faịlụ n'ime folda ahụ site na iji Windows Notepad ma ọ bụ macOS TextEdit wee lelee mpaghara atọ: - "permissions" na "host_permissions": Chọọ maka ikike nwere nnukwu ihe egwu gụnyere "cookies", "webRequest", "declarativeNetRequest", "clipboardRead", "clipboardWrite", "scripting", "debugger", "proxy", na "<all_urls>". Mgbatị na-ekwu na ọ bụ "Ụdị Mgbanwe Ọchịchịrị" dị mfe ma ọ bụ "Booster Volume" nke na-arịọ "cookies" na "<all_urls>" ọ fọrọ nke nta ka ọ na-ewe oge nbanye. - "content_scripts": Na-egosi faịlụ Javascript (content.js, inject.js) na-agbanye n'ime ibe weebụ ọ bụla ị gara, gụnyere ụlọ akụ na ọnụ ụzọ akpa ego crypto. - "background" ("service_worker"*: Na-achọpụta edemede ndabere na-adịgide adịgide (background.js ma ọ bụ sw.js). Na-achọ faịlụ Javascript ahụ na Notepad maka eriri dị ka fetch(, XMLHttpRequest, WebSocket, navigator.clipboard, chrome.cookies.getAll, eth_sendTransaction, ma ọ bụ atob( na-ekpughe iwu na njikwa nke onye mwakpo (C2) ngalaba wee gosi kpọmkwem ihe data ewepụtara.

Nzọụkwụ 3: Lelee Browser Shortcut Target Hijacking (--load-extension)¶

Ọbụna mgbe ịpịrị ** Wepụ *** n'ime chrome://extensions, Usoro trojan a na-ahụkarị na-agbanwe akara ngosi mkpirisi desktọpụ na taskbar ị pịa ka ịmalite Chrome, Edge, ma ọ bụ Brave ka ọ na-ebughachi ihe ndọtị na-adịghị mma zoro ezo na-akpaghị aka mgbe ọ bụla i meghere ihe nchọgharị ahụ. - ** Na Windows *: 1. Pịa aka nri na akara ngosi ** Google Chrome / Microsoft Edge / Brave ** na desktọpụ gị (ma pịa akara ngosi dị na Taskbar gị -> pịa aka nri aha ihe nchọgharị ọzọ -> pịa ** Properties). 2. Lee igbe Ekwadoro: n'okpuru taabụ ** Ụzọ mkpirisi. 3. Igbe ebumnuche dị ọcha na-ejedebe "chrome.exe" ma ọ bụ "msedge.exe": - ** Ọ dị ọcha ***: "C:\Program Files\Google\Chrome\Application\chrome.exe" - ** AKWỤKWỌ ***: "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\Public\Documents\ExtUpdater" https://search-hijack.com 4. Hichapụ ihe niile ma emechaa chrome.exe" (ma ọ bụ hichapụ ụzọ mkpirisi ahụ kpamkpam wee pinye ụzọ mkpirisi ọhụrụ ozugbo site na C:\Program Files\Google\Chrome\Application\chrome.exe).

Kwụpụ 4: Hichapụ faịlụ ndọtị fọdụrụ na ndị ọrụ ọrụ na diski¶

Chọta ndekọ profaịlụ mpaghara ihe nchọgharị gị wee hichapụ obere nchekwa nke dabara na NJ agwa 32 nke rogue ndọtị, gbakwunyere ihichapụ ndị ọrụ ọrụ edebanyere aha:

Mgbe ihichapụ folda ndọtị, mepee chrome://serviceworker-internals (ma ọ bụ edge://serviceworker-internals) na ihe nchọgharị gị wee pịa ** Debanye aha ** na onye ọrụ ọ bụla metụtara ndọtị wepụrụ ma ọ bụ ngalaba ọkwa ọkwa amabeghị.

Kwụpụ 5: Hichapụ ikike ngosi Rogue Push, ngwa nchọta ezoro ezo na ntọala proxy / DNS.¶

Ọtụtụ mgbasawanye adware na ndị na-eme ihe nchọgharị na-ahapụ ọnyà atọ nke abụọ ọbụlagodi mgbe ehichapụchara ọnụọgụ abụọ ndọtị: 1. Kagbuo ndebanye aha ngosi Push Weebụ ọjọọ (Mkpọpụta mgbochi nje adịgboroja): - Ọ bụrụ na adịgboroja nje McAfee, Norton, ma ọ bụ Windows Defender na-agbapụta n'akụkụ aka nri nke ihuenyo gị mgbe ọ bụla ihe nchọgharị gị mepere, ndị ahụ bụ ** HTML5 Weebụ Push Notifications** sitere na saịtị rogue ị nyere ikike ngosi na mberede. - Mepee chrome://settings/content/notifications (ma ọ bụ edge://settings/content/notifications / about:preferences#privacy -> Ikikere -> Amamọkwa *** na Firefox). - Pịgharịa gaa na ndepụta "Ekwenyere izipu ọkwa", pịa ntụpọ atọ dị n'akụkụ ngalaba ọ bụla amabeghị ma ọ bụ enyo, wee pịa ** Wepụ *** ma ọ bụ ** Gbochie . 2. ** Tọgharia ngwa nchọta izizi & ibe mmalite: - Mepee chrome://settings/searchEngines (edge://settings/search) ma chọpụta na njin ọchụchọ gị na-ezo aka na ezigbo Google (google.com), DuckDuckGo, ma ọ bụ Bing kama URL redirect dị ka (search.yahoo.com/yhs/... ma ọ bụ find-results.net). Hichapụ ngwa nchọta niile amatabeghị na listi ahụ. - Mepee chrome://settings/onStartup (edge://settings/onStartup) wee lelee "Mepee otu ibe ma ọ bụ ntọala ibe": wepụ URL mmalite ọ bụla amabeghị nke adware gbanyere. 3. ** Lelee maka Proxy Sistemu Ejichiri ma ọ bụ DNS echekwara (DoH) Ntọala*: - Ụfọdụ ndọtị ọjọọ na ndị nrụnye adware na-ahazi script PAC (Proxy Auto-Config) mpaghara ** ma ọ bụ rogue ** DNS-over-HTTPS (DoH ihe nkesa ka ha nwee ike ịga n'ihu na-egbochi okporo ụzọ weebụ gị mgbe ndọtị ahụ kwụsịrị. - Na Chrome/Edge, gaa na chrome://settings/security -> pịgharịa gaa na Jiri DNS echekwara wee chọpụta na edobere ya na ndị na-ahụ maka ọrụ gị ugbu a ma ọ bụ onye na-edozi ọha tụkwasịrị obi (Cloudflare 1.1.1.1, Quad9 9.9.9.9, ma ọ bụ Google Public DNS), ọ bụghị URL omenala pụrụ iche. - Wee mepee chrome://settings/system -> pịa ** Mepee ntọala proxy nke kọmpụta gị**, wee chọpụta na "Jiri edemede ntọala" na "Jiri ihe nkesa proxy" agbanyụrịrị ** Gbanyụọ** (ọ gwụla ma onye were gị n'ọrụ chọrọ).

Usoro 2: Wepụ atumatu ụlọ ọrụ adịgboroja "Ndị otu gị jisiri ike"ExtensionInstallForcelist)¶

Ọ bụrụ na ịnọ na kọmputa ** nkeonwe nkeonwe *** (ọ bụghị laptọọpụ nke onye were gị n'ọrụ ma ọ bụ ụlọ akwụkwọ nyere) ma ị nweghị ike pịa bọtịnụ ** Wepụ *** na ndọtị a na-enyo enyo n'ihi na o nwere obere akara ngosi ụlọ ọrụ n'akụkụ ya yana Chrome/Edge gosipụtara “Ndị otu gị na-ejikwa ihe nchọgharị gị”, adware agbabala iwu ụlọ ọrụ adịgboroja n'ime sistemụ arụmọrụ gị.

Nzọụkwụ 1: Nyochaa chrome://policy ma ọ bụ edge://policy¶

Ụdị chrome://policy (ma ọ bụ edge://policy / about:policies na Firefox) banye n'ụlọ mmanya adreesị gị. - Chọọ aha amụma dịka ExtensionInstallForcelist, ExtensionInstallAllowlist, ExtensionSettings, HomepageLocation, RestoreOnStartupURLs ma ọ bụ DefaultSearchProviderSearchURL . - Kọlụm Uru na-esote ExtensionInstallForcelist ga-egosipụta NJ ndọtị 32 agwa nke ndọtị malware yana URL mmelite ọ na-adọta.

Kwụpụ 2: Hichapụ Atumatu Nchọgharị Rogue na Windows (Elu Iwu ozugbo)¶

N'ụlọ nkeonwe Windows 10 ma ọ bụ Windows 11 PC nke kwesịrị ** agaghị enwe usoro ihe nchọgharị ụlọ ọrụ ọ bụla etinyere, pịa Malite NchNhr, ụdị cmd, pịa aka nri ** Ngwa ngwa ngwa ***, họrọ ** Gbaa dị ka onye nchịkwa ***, wee mebie iwu ndị a ka ihichapụ hives ndekọ amụma chrome, Edge na Brave wee weghachi amụma otu:

reg delete "HKLM\SOFTWARE\Policies\Google\Chrome" /f
reg delete "HKCU\SOFTWARE\Policies\Google\Chrome" /f
reg delete "HKLM\SOFTWARE\Policies\Google\Update" /f
reg delete "HKCU\SOFTWARE\Policies\Google\Update" /f
reg delete "HKLM\SOFTWARE\WOW6432Node\Google\Enrollment" /f
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Edge" /f
reg delete "HKCU\SOFTWARE\Policies\Microsoft\Edge" /f
reg delete "HKLM\SOFTWARE\Policies\BraveSoftware\Brave" /f
reg delete "HKCU\SOFTWARE\Policies\BraveSoftware\Brave" /f
rmdir /s /q "%WinDir%\System32\GroupPolicy"
rmdir /s /q "%WinDir%\System32\GroupPolicyUsers"
gpupdate /force

Mgbe ịmechara iwu ndị ahụ, laghachi na chrome://policy (ma ọ bụ edge://policy) wee pịa bọtịnụ ** Bugharịa amụma *** dị n'akụkụ aka ekpe n'elu. Atumatu ụlọ ọrụ mmanye ga-apụ n'anya ozugbo, bọtịnụ ** Wepụ *** banye chrome://extensions ga-emeghe.

Kwụpụ 3: Hichapụ amụma ihe nchọgharị Rogue & profaịlụ nhazi na macOS¶

Na MacOS, ndị na-eme ihe nchọgharị na-amanye iwu ụlọ ọrụ adịgboroja site na iji usoro abụọ: 1. Profaịlụ Nhazi MacOS (MDM profaịlụ) na a ghọgburu onye ọrụ iji wụnye site na nrụnye ihe ọkpụkpọ Flash/video adịgboroja, yana **2. Jisiri ike plist faịlụ mmasị ***.

1. ** Lelee ma wepụ Profaịlụ nhazi MacOS ọjọọ ***:
2. Mepee ** NchNhr Apple -> Ntọala Sistemu -> Ozuruọnụ -> Njikwa ngwaọrụ ** (na MacOS Monterey/Big Sur ochie, mepee ** Mmasị sistemụ -> Profaịlụ **).
3. Ọ bụrụ na ịnọ na Mac nkeonwe wee hụ profaịlụ ** ọ bụla edepụtara n'okpuru njikwa ngwaọrụ / profaịlụ (a na-akpọkarị * “Ntọala Chrome”*, “SearchConfig”, “AdminPrefs” ma ọ bụ “WeKnow”), họrọ ya wee pịa **- (Wepụ) *** bọtịnụ dị na ala, wee tinye paswọọdụ Mac gị ka ihichapụ ya.
4. ** Hichapụ ihe nchọgharị ejisiri plist Faịlụ site na MacOS Terminal ***:
5. Mepee ** Terminal *** (Cmd + Space, ụdị Terminal) ma mee iwu ndị a iji wepụ mmanye plist faịlụ iwu ma kpochapụ ihe cfprefsd cache:

sudo rm -f /Library/Managed\ Preferences/com.google.Chrome.plist
sudo rm -f /Library/Managed\ Preferences/*/com.google.Chrome.plist
sudo rm -f /Library/Preferences/com.google.Chrome.plist
rm -f ~/Library/Preferences/com.google.Chrome.plist
sudo rm -f /Library/Managed\ Preferences/com.microsoft.Edge.plist
sudo rm -f /Library/Preferences/com.microsoft.Edge.plist
defaults delete com.google.Chrome ExtensionInstallForcelist 2>/dev/null
defaults delete com.google.Chrome HomepageLocation 2>/dev/null
sudo killall cfprefsd

Malitegharịa ekwentị Chrome/Edge wee nyochaa na chrome://policy na amụma efu ka na-arụ ọrụ.

Nkeji 3: Ịchọta na ikpochapụ Ndị Nhicha Clipboard Crypto ("Clippers") ọkwa OS.¶

Kedu ihe ma ọ bụrụ na ị wepụrụ ndọtị ihe nchọgharị ọ bụla, mechie ihe nchọgharị gị kpamkpam, wee nwalee iṅomi adreesị obere akpa crypto (0x... ma ọ bụ bc1...) n'ime Windows Notepad ma ọ bụ macOS TextEdit, yana ** adreesị e depụtara ka na-agbanwe n'ime adreesị obere akpa onye mwakpo**?

Nke ahụ pụtara ọnụọgụ nrụnye ihe nrụnye nke sistemụ arụmọrụ Malware ọnụọgụ abụọ** (Laplas Clipper, ClipBanker, phemedrone, RedLine, ma ọ bụ rogue Python/Node/AutoIt) na-agba n'azụ sistemụ arụmọrụ gị wee kpọọ Windows. AddClipboardFormatListener / SetClipboardData API (ma ọ bụ macOS NSPasteboard loop ntuli aka).

Kwụpụ 1: Chọpụta Usoro Na-ejide ugbu a ma ọ bụ Ntuli Aka Klipbọọdụ Gị¶

• ** Na Windows (Usoro ndụ PowerShell na nyocha mmalite) ***: Mepee ** PowerShell dị ka onye nchịkwa ** wee mee iwu nyocha a ka ịdepụta usoro ndabere na-abụghị Microsoft na-agwụ na akwụkwọ ndekọ aha onye ọrụ nwere ike ide.AppData, Temp, ProgramData, Users\Public) ebe pasent 99 nke Clipper Trojans bi:

Get-CimInstance Win32_Process | Where-Object {
    $_.ExecutablePath -match "AppData|Temp|ProgramData|Users\\Public"
} | Select-Object ProcessId, Name, ExecutablePath, CommandLine | Format-List

Lelee mmepụta maka enyo .exe, pythonw.exe, wscript.exe, cscript.exe, powershell.exe, mshta.exe, ma ọ bụ AutoIt3.exe usoro na-agba ọsọ %AppData%\Roaming, %LocalAppData%\Temp, ma ọ bụ C:\ProgramData. Rịba ama ProcessId (PID) na ExecutablePath, kwụsị usoro na Stop-Process -Id <PID> -Force, ma hichapụ ọnụọgụ abụọ na diski.

• ** Nyochaa ebe Windows na-adịgide adịgide (Run Igodo & Scheduled Tasks***: Clippers na-adị ndụ reboots site na ịgbakwunye ndekọ Run igodo, mmalite .lnk faịlụ na shell:startup, ma ọ bụ ọrụ akwadoro. Gbaa nlele PowerShell abụọ a ka ikpughe ha:

Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run", "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
Get-ScheduledTask | Where-Object {$_.State -ne "Disabled" -and $_.Author -notmatch "Microsoft"} | Select-Object TaskName, TaskPath, State

Budata Microsoft Sysinternals Autoruns (Autoruns64.exe) si learn.microsoft.com/en-us/sysinternals/downloads/autoruns, Gbaa ya dị ka onye nchịkwa, mee ka ** Nhọrọ -> Nhọrọ nyocha -> Nyochaa mbinye aka koodu + Lelee VirusTotal.com**, ma hichapụ ihe ọ bụla na-acha uhie uhie/edebanyeghị aha na taabụ ** Logon**, Ehazie, ma ọ bụ WMI.

• ** Na macOS (Mwepụta Agents & Nyocha Usoro ndabere) ***: Mepee ** Terminal ** wee lelee onye ọrụ na sistemụ niile LaunchAgents na LaunchDaemons (ebe macOS clippers na Atomic Stealer / Poseidon zoo scripts nnọgidesi ike):

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons
ps aux | grep -E "osascript|python|node|curl|base64|NSPasteboard"

Nyochaa ihe ọ bụla na-amaghị .plist faịlụ na -/Library/LaunchAgents iji cat -/Library/LaunchAgents/<filename>.plist, budata ya launchctl unload -/Library/LaunchAgents/<filename>.plist, ma hichapụ ha abụọ .plist na ọnụọgụ abụọ ọ na-arụtụ aka.

Nkeji 4: mgbake ọrịa butere (ịkagbu kuki nnọkọ ezuru ohi, akara OAuth na nnabata Web3)¶

Ihichapụ ndọtị ihe nchọgharị ọjọọ na-akwụsị nledo n'ọdịnihu, mana ọ naghị emebi kuki nnọkọ, okwuntughe echekwara, ma ọ bụ mkpụrụokwu mkpụrụ akpa ego ndọtị ebugogoro na sava onye mwakpo mgbe arụnyere ya. Chee na taabụ ọ bụla mepere emepe yana okwuntughe ọ bụla echekwara n'ime njikwa okwuntughe arụnyere n'ime ihe nchọgharị emebiela:

1. ** Manye "Banye n'Ọgbakọ niile" zuru ụwa ọnụ na Akaụntụ Gị Dị Mkpa ***:
2. ** Naanị ịgbanwe okwuntughe mgbe ụfọdụ na-ahapụ akara ngosi OAuth dị adị ma ọ bụ oge mkpanaka/webụ ihe ruru otu elekere.** Banye na ngwaọrụ dị ọcha wee pịa n'ụzọ doro anya ** Banye na nnọkọ niile / kagbuo ngwaọrụ niile ***:
   • *Google/Gmail: myaccount.google.com/device-activity -> họrọ oge ọ bụla na-amaghị ma ọ bụ desktọpụ -> ** Pụta ***. Leleekwa myaccount.google.com/permissions kagbuo ngwa OAuth nke ndị ọzọ.
   • ** Microsoft / Outlook / 365 ***: account.live.com/proofs/manage/additional -> pịa ** Hapụ m ** (na-amanye ịpụpụ n'ụwa niile n'ime ihe nchọgharị niile n'ime awa 24).
   • ** GitHub / GitLab / AWS / Igwe igwe ojii ***: Gaa na github.com/settings/sessions -> ** Kagbuo nnọkọ niile ***, ma tụgharịa Token nnweta nkeonwe ọ bụla (PATs) ma ọ bụ SSH igodo.
   • ** Discord / Slack / Social Media ***: Mara na ndọtị obi ọjọọ na-elekwasị anya Discord's. Local Storage nzere token na kuki Business Manager Facebook; gbanwee okwuntughe Discord gị (nke na-emegharị akara njirimara Discord gị na-akpaghị aka) wee kwụsị oge niile na-arụ ọrụ na Facebook/Instagram Settings.
3. ** Bugharịa obere akpa Crypto sọftụwia ọ bụla (MetaMask, Phantom, Rabby, Keplr) Awụnyere ya n'otu ihe nchọgharị ahụ ***:
4. Ọ bụrụ na ndọtị obi ọjọọ nwere <all_urls> ma ọ bụ scripting nweta, ma ọ bụ ọ bụrụ na ọkwa ọkwa OS na-agba ọsọ na PC gị, ọ nwere ike gụọ faịlụ vault gị ezoro ezo (ldb faịlụ na Local Extension Settings) wee weghara paswọọdụ mkpọghe obere akpa gị ka ị na-ede ya.
5. Edokwala ego n'ime mkpụrụokwu mkpụrụ obere akpa ahụ na-ekpo ọkụ. Mepụta mkpụrụokwu mkpụrụ obere akpa ọhụrụ na ** ngwaọrụ dị ọcha ma ọ bụ obere akpa ngwaike (Ledger, Trezor, Keystone***, bufee akụ gị fọdụrụ na obere akpa ọhụrụ, ma kagbuo nkwenye token na revoke.cash na-eso anyị Mgbapu obere akpa cryptocurrency na ntuziaka mgbaghara mkpụrụokwu.
6. Mee nrụpụta ihe nchọgharị zuru oke:
7. Gaa na chrome://settings/reset (edge://settings/reset / about:support -> Megharịa Firefox) wee pịa ** Weghachite ntọala na ndabara mbụ ha **. Nke a na-atọgharị ibe mmalite gị, ibe taabụ ọhụrụ, injin nchọta na taabụ etinyere, na-ekpochapụ kuki nwa oge, ma gbanyụọ ndọtị ọ bụla fọdụrụnụ.

Ajụjụ a na-ajụkarị¶

Kedu ihe kpatara ndọtị m ji n'enweghị nsogbu maka afọ 2 wee ghọọ malware ma ọ bụ adware na mberede?¶

Mgbakwunye ihe nchọgharị na-emelite na-akpaghị aka na na nzuzo na ndabere na-arịọghị ikike gị ma ọ bụrụ na ụdị ọhụrụ ahụ rịọrọ ụdị ikike ọhụrụ. Ndị omekome cyber na ndị otu mgbasa ozi mgbasa ozi na-akpọtụrụ ndị mmepe solo nke ewu ewu, ndọtị ziri ezi (dị ka ngwa PDF, ihe nkwalite olu, ihe ndekọ ihuenyo, ma ọ bụ ihe mgbochi mgbasa ozi) wee nye ha puku kwuru puku dollar ka ha ree akaụntụ onye nrụpụta Weebụ Chrome ha ma ọ bụ bufee nwe ndọtị ahụ. Ozugbo onye zụrụ ya chịkwaa ndepụta ahụ, ha na-akwali ụdị mmelite dị jụụ nwere izu ohi kuki ma ọ bụ koodu mmekọ nke na-emerụ onye ọrụ ọ bụla dị n'otu abalị.

Google's Manifest V3 nwelite ọ na-eme ka Chrome na Edge gbasaa kpamkpam na malware?¶

Ee e. Ọ bụ ezie na Gosipụta V3 budata mma nche site machibido extensions si loading remotely hosted executable JavaScript code si mpụga sava (na-amanye niile koodu na-bundled n'ime ndọtị ngwugwu osụk na ụlọ ahịa), obi extensions chịkọtara n'okpuru Manifest V3 ka nwere ike na-emegbu sara mbara nnabata ikike (Na saịtị niile), na-agụ DOM ụdị ntinye na igodo strokes, kuki kuki, na-ezu ohi na clip search site na nchọta, site na nchọta mapuni. iwu nkwupụta NetRequest. Ịmachi ndọtị nye naanị ndị ị tụkwasịrị obi kpamkpam na ịtọ ikike ịnweta saịtị ha ka “na pịa” kama “Na saịtị niile” ka dị mkpa.

Kedu otu m ga-esi chebe mbufe cryptocurrency m site na malware hijacker clipboard n'ọdịnihu?¶

Nke mbụ, enyochala naanị mkpụrụedemede 4 na nke ikpeazụ nke adreesị obere akpa, n'ihi na malware nke ọgbara ọhụrụ na-eji ọdọ mmiri adreesị efu agbakọgoro tupu ya ahọrọ adreesị onye mwakpo na-ekekọrịta otu mkpụrụedemede mmalite na njedebe dị ka onye nnata gị chọrọ; lelee mkpụrụedemede isii mbụ, etiti 6 na nke ikpeazụ. Nke abụọ, jiri obere akpa ngwaike na-anọghị n'ịntanetị nwere ihuenyo anụ ahụ (dị ka Ledger, Trezor, ma ọ bụ GridPlus) wee nyochaa adreesị nnata zuru oke na ihuenyo ahụ ngwaọrụ ngwaike tupu ịpị bọtịnụ nkwenye anụ ahụ, wee chekwaa adreesị nnata a na-ejikarị n'ime akwụkwọ adreesị ọcha nke obere akpa gị kama ịdegharị na mado ha na klipbọọdụ gị.

enyochara isi mmalite¶

• Ụlọ ọrụ nchekwa Cybersecurity na akụrụngwa (CISA, United States) & Ụlọọrụ Federal Bureau of Investigation (FBI): Ndụmọdụ nchekwa cyber nke jikọrọ ọnụ na Infostealer Malware, Hijacking kuki nnọkọ, yana ndọtị ihe nchọgharị ọjọọ.
• National Institute of Standards and Technology (NIST, United States): * SP 800-83 Mkpu. 1, Nduzi maka Mgbochi na njikwa ihe omume Malware maka Desktop na Laptọọpụ*.
• Ụlọ ọrụ Google Chrome na Otu Nchebe Chromium: * Ndepụta amụma ụlọ ọrụ Chrome (ExtensionInstallForcelist), Gosipụta ihe owuwu nchekwa ndọtị V3, yana idozi ntinye iwu na-akwadoghị *.
• Ebe nzaghachi nchekwa Microsoft (MSRC) & Ọgụgụ isi iyi iyi egwu Microsoft Defender: Ntụle na Ndozigharị CrypToClipper / Clipboard Hijacker Malware na Rogue Nchọgharị Amụma Ịkwụsị Ịdebanye aha (HKLM\SOFTWARE\Policies\Microsoft\Edge)
• Ebe nchekwa cyber nke mba (NCSC, United Kingdom): Nduzi nchekwa ngwaọrụ: Ijikwa ndọtị ihe nchọgharị, njikwa amụma ụlọ ọrụ, yana mbelata izu ohi Token.

Ntuziaka emetụtara¶

• Mgbapu obere akpa Cryptocurrency, mebie nkebi ahịrịokwu mkpụrụ, na kagbuo nkwenye
• Malware, ransomware na mwepụ ọrịa spyware
• MFA phishing, onye iro na-etiti (AiTM) gafere, na izu ohi kuki.
• Nzaghachi mmebi data, okwuntughe mwepu, na kredit kwụsịrị
• Nọmba mberede site na obodo