Kordhinta Browser-ka xaasidnimada leh, Afduubayaasha Clipboard-ka Crypto, iyo Dib-u-dejinta Browser¶

Isagoo og in cinwaanka jeebka cryptocurrencyBTC, ETH, SOL, USDT) ama bangiga IBAN/lambarka dariiqa ee aad hadda ku koobiyaysay Ctrl+C (Cmd+C) si sixir ah ayaa isku badashay ciwaanka shisheeyaha isla markiiba aad riixday Ctrl+V (Cmd+V), ogaanshaha in Chrome, Edge, Brave, ama Firefox kordhinta aad ku rakibtay sanado ka hor ("Beddelka PDF", "Booster Volume", "Video Downloader", ama "AI Assistant") si qarsoodi ah looga iibiyay shirkad adware ah oo hadda isku duraya xiriiriyeyaasha xiriirka la leh iyo goosashada cookies-ka fadhigaaga, ama helitaanka mashiinka raadintaada caadiga ah ee ku xiran bogga wareejinta ee la afduubay ee fariintaada hoosteeda degdeg ah. Sababtoo ah daalacayaasha webka casriga ahi waxay hayaan cookies-kaaga fadhiga la xaqiijiyay ee Gmail, Microsoft 365, konsolayaasha daruuraha shirkadaha, maamulayaasha erayga sirta ah, iyo jeebadaha Web3, hal biraawsar oo dheeraad ah ayaa la siiyay. "Read and change all your data on all websites" (<all_urls> ama *://*/* oggolaanshaha martida loo yahay) wuu dhaafaa Xaqiijinta Qodobbada Badan (MFA) gabi ahaanba adiga oo akhrinaya DOM galintaada, furayaasha furaha, iyo navigator.clipboard kaydinta waqtiga dhabta ah.

Haddi u tanaasulka browserku ay weheliso baad fir fircoon, hanjabaad jidheed, ama silig shirkadeed oo socda, wac nambarka degdega ah ee deegaankaaga (911 Maraykanka iyo Kanada, 112 guud ahaan Midowga Yurub, 999 gudaha Boqortooyada Ingiriiska) ama kala tasho buug-tusahayaga caalamiga ah nambarada degdega ah isla markiiba. Dhammaan kiisaska fidinta browserka xaasidnimada leh, crypto clipboard clipper malware, ama afduubka siyaasadda browserka, ku fuli ka saarista dembiilaha iyo socodka shaqada kala noqoshada kalfadhiga hoose.

Hadda samee tan¶

1. ** JOOJI dhejinta xogta xasaasiga ah (Ctrl+V / Cmd+Viyo WALIGAA ha aqbalin macaamil ganacsi cryptocurrency ah adiga oo aan xaqiijin 6 iyo 6 xaraf ee ugu dambeeya ee shaashadda boorsada qalabkaaga ***: Afduubayaasha Clipboard malware ("Clippers" / CrypToClipper) isticmaala tibaaxo joogto ah (RegEx) si aad ula socoto nidaamkaaga hawlgalka iyo sabuuradda browserka 100kii millise secondsba. Isla markiiba aad koobiyayso a 0x... Ciwaanka Ethereum, bc1... Ciwaanka Bitcoin, ama ciwaanka Solana, waxa ay ku badashaa waxa ku jira sabuuradda ciwaan u eg oo uu leeyahay qofka weerarka gaystay.
2. ** Ka saar kumbiyuutarka cudurka qaba Wi-Fi / Ethernet ka hor inta aan la furin chrome://extensions (edge://extensions / about:addons***: Kordhiyo badan oo xaasidnimo ah ayaa u fiirsada isticmaalaha u socdaalaya tab maaraynta kordhinta oo ama si toos ah u xidh tabka, isqariya, ama qashin qubka ugu dambeeya ee cookies-kaaga fadhiga furan ka hor intaadan gujin Ka saar. Deminta Wi-Fi marka hore waxay gooysaa amarkooda iyo xakamayntooda (C2) kanaalka.
3. • Dami "Extensions Sync" ee Google, Microsoft, ama Mozilla ka hor intaan la tirtirin kordhinta qallafsan : Haddii Chrome Sync, Edge Sync, ama Firefox Sync la furo, tirtirida kordhinta xaasidnimada ah gudaha hal laptop inta badan way guul dareysataa sababtoo ah astaantaada daruuriga ah ama desktop-ka kale ee la soo galiyay ayaa si toos ah dib ugu riixaya kordhinta mashiinkaaga daqiiqado kadib. Tag chrome://settings/syncSetup/advanced (edge://settings/profiles/sync) oo u rogo Extensions** marka hore
4. **Diiw 32-xaraf Aqoonsiga Kordhinta (Developer Mode -> ID) oo tirtir kordhinta IYO deegaankeeda IndexedDB / Local Extension Settings Faylka diskka ***: Kahor intaadan gujin **Ka saar *, shid ** Qaabka horumariyaha ee geeska kore ee midig ee chrome://extensions oo qor aqoonsiga 32-xaraf (tusaale ahaan, aeblfdkhhhdcdjpifhhbdiojplfjncoa). Ogaanshaha aqoonsiga saxda ah wuxuu kuu ogolaanayaa inaad xaqiijiso in kordhinta loo calaamadeeyay malware oo aad nadiifiso galka haray ee gudaha deegaankaaga AppData / Library hagaha.
5. ** Ka saar siyaasadaha browserka ganacsiga beenta ahchrome://policy iyo edge://policy) oo dhahaya "Braawsarkaaga waxaa maamula ururkaaga"**: Kombiyuutarka guriga ee gaarka ah, marka la arko "Maamula ururkaaga" macnaheedu waa adware ama trojan ayaa qoray rogue ExtensionInstallForcelist ama SearchProvider furaha diiwaanka Windows kaaga (HKLM\SOFTWARE\Policies\Google\Chromeama MacOS qaabeynta Profiles (System Settings -> General -> Device Management) markaa ma gujin kartid badhanka saar.
6. ** burin dhammaan cookies-ka kalfadhiga browser-ka la xado adigoo gujinaya "Ka bax dhammaan fadhiyada" qalab nadiif ah ***: Sababtoo ah kordhin xaasidnimo leh <all_urls> ogolaansho ama chrome.cookies Helitaanka ayaa mar hore nuqul ka sameystay calaamadahaaga galitaanka tooska ah, si fudud u tirtirida kordhinta ** kama saarayso weerarka akoonnadaada. Adeegso taleefan casriga ah oo nadiif ah si aad u qasbi caalami ah Ka Bax Aaladaha oo dhan / Ka Noqo Kalfadhiyada iimaylkaaga, bangigaaga, daruuraha, iyo akoonnada bulshada, oo beddel furahaaga sirta ah adoo raacaya Jawaabta jebinta xogta iyo hagaha daadinta erayga sirta ah.

Geedka go'aanka: go'doominta hanjabaadaha fidinta browserka, afduubayaasha siyaasadda, iyo goosiyeyaasha OS¶

Raac jaantuskan ogaanshaha ogaanshaha si aad u ogaato lakabka biraawsarkaaga ama nidaamka qalliinka ee la jabiyay oo ciribtiro habka joogtada ah:

flowchart TD
    Start["Browser Anomaly La Helay: Ciwaanka Boodhadhka Waa La Kala Bedelay, Raadinta La Hawiyay, Soo Baxa Daahsoon, ama Kalfadhiga Koontada La Xaday"] --> Test{"1. Xidhi browserka gabi ahaanba oo koobi/ku dheji ciwaanka Crypto ee notepad/ TextEdit: miyay isbedelaysaa?"}
    Test -->|"Haa: Ciwaanka Wuu Isbadalay browserka Dibadeed"| OSClip["HEERKA OS-CLIPPER MALWARE: Dila nidaamka qallafsan ee Maareeyaha Hawsha, Nadiifi Hawlaha Jadwalsan / Furaha Furaha & Orod Khadka Tooska ah AV Scan"]
    Test -->|"Maya: Kaliya Waxa Ay Ka Dhacdaa Gudaha browserka"| PolicyCheck{"2. Fur chrome://policy or gees:://policy: Xeerarka ma ku qoran yihiin kombayutarka gurigaaga?"}
    PolicyCheck -->|"Haa: 'Waxaa maamula ururkaaga' / ExtensionInstallForcelist"| WipePolicy["Tirtir Furayaasha Siyaasadda Diiwaangelinta Windows ee Rogue (Xeerarka HKLM/HKCU) ama ka saar xogta qaabeynta macOS"]
    PolicyCheck -->|"Siyaasado lama helin"| ExtAudit["3. Dami isku-xidhka -> Ka yeel habka horumariyaha ee chrome://extensions -> Aqoonso oo ka saar kordhinta xaasidnimada"]
    WipePolicy --> ExtAudit
    OSClip --> ExtAudit
    ExtAudit --> DiskWipe["4. Tirtir faylalka Fidinta Hadhaaga, Shaqaalaha Adeegga & Kaydka IndexedDB ee Tusaha Macluumaadka Isticmaalaha Maxaliga ah"]
    DiskWipe --> CookieRevoke["5. Qalabka Nadiifka ah: Ka noqo Dhammaan Kulamada Firfircoon (Google, Microsoft, GitHub, Bangiyada) & Hubi Ansixinta Crypto"]

Sidee balaadhinta sharciga ah ee biraawsarkaaga u noqdaan xaasidnimo habeen (iyo 5ta nooc ee weerar)¶

In ka badan 70 boqolkiiba dhibbanayaasha uu ku dhacay biraawsarkaaga xaasidnimada ah weligood ma gujin isku xirka software-ka hadhsan: waxay si toos ah ugu rakibeen bakhaarka shabakada Chrome, Microsoft Edge Add-ons Store, ama Firefox Add-onsAMO bilood ama sanado ka hor. Dembiilayaasha internetka waxay wax u dhimaan kordhinta iyaga oo u maraya laba hab oo silsilad sahay ah: 1. Qaadashada Kordhinta/Lacagta Lacag-ururinta (halkaas oo uu weerarku ku bixiyo horumariye madax-bannaan $5,000 ilaa $50,000 oo caddaan ah si uu u iibsado lahaanshaha 100,000 isticmaale ee caanka ah, ka dibna riixo is-cusboonaysiinta aamusnaanta leh oo ay ku jiraan malware-ka qarsoon oo isticmaale kasta oo jira browserkiisu si toos ah u soo dejiyo gadaal); iyo 2. Horumariyaha OAuth Phishing (halkaas oo ay weerarayaashu ku khiyaaneeyaan koontada horumariyaha dukaanka Shabakadda ee Chrome, sida ku dhacday jebinta silsiladda saadka ee waaweyn ee saameeya daraasiin shirkado iyo amni kordhin ah).

Wajiga 1: Sida loo xisaabiyo, loo garto, oo looga sifeeyo kordhinta xaasidnimada leh ee Chrome, Edge, Brave, Firefox, iyo Safari¶

Si fudud ha u eegin calaamadaha ku xiga ciwaankaaga: kordhinta xaasidnimada leh waxay si badheedh ah u qariyaan astaanta aaladda (Action badhanka qarsoon) ama masquerade adoo isticmaalaya astaanta saxda ah iyo magaca Google Docs Offline, Google Translate, uBlock Origin, ama Adobe Acrobat.

Talaabada 1: Baadh kordhintaada rakiban oo Qabo aqoonsiga 32-jilaa¶

1. ** Ka saar kombiyuutarkaaga Wi-Fi/Ethernet** si aanay wax kordhin ahi u gudbin karin xog-bixin kama dambeys ah ama is-cusboonaysiin markaad kormeerayso.
2. Fur console-ka maamulka fidinta gudaha ee biraawsarkaaga adiga oo ku qoraya URI sax ah barta ciwaanka:
3. ** Google Chrome ***: chrome://extensions
4. Microsoft Edge: edge://extensions
5. ** Browser geesinimo leh ***: brave://extensions
6. Mozilla Firefox: about:addons (iyo sidoo kale ku qor about:debugging#/runtime/this-firefox si aad u aragto wax-ku-kordhin ku-meel-gaar ah/qarsoon)
7. Apple Safari (macOS): Safari -> Settings (Cmd + ,) -> Extensions
8. Daar "Qaabka horumariyaha"** (ku beddel koonaha midig ee sare ee Chrome, Edge, iyo Brave).
9. Daar qaabka soo-saare wuxuu muujinayaa faahfaahinta baaritaanka muhiimka ah ee kaadhka kordhinta kasta:
10. ID: Xadhig xarfo yar oo 32-xaraf ah oo gaar ah (sida cjpalhdlnbpafiamejdnhcphjbkeiagm).
11. Inspect views: service worker / background page: Waxay tustaa in kordhintu ay si firfircoon u wado qoraalka asalka ah hadda.
12. Source: Installed by enterprise policy ama Loaded from: C:\Users\... (Kordhinta Aan Xidhnayn): Ilaa aad tahay soo-saare kombuyuutar oo adigu qoray fidinta, ** macaamiil sharci ah oo dheeraad ah waa inuu waligii odhan Loaded from: [Folder Path] (Kordhin Aan Xidhnayn)**. Qorayaasha Malware waxay dhinac ka raraan kordhinta aan baakadka ahayn ee qarsoon AppData ama ProgramData faylalka iyada oo loo marayo hagaajinta gaabanchrome.exe --load-extension="C:\...") si aad gabi ahaanba uga gudubto iskaanka amniga ee Bakhaarka Mareegta Chrome.
13. ** Ka hubi kordhin kasta oo ka soo horjeeda shuruudahan ka saarida ***:
14. Guji ** Faahfaahin -> Ogolaansho (Site access*** Kordhinta kasta. Muddo kordhin kasta oo leh On all sites (Read and change all your data on all websites taas oo aan ahayn aalad si qoto dheer loo aamini karo, la xaqiijin karo oo isha furan (sida maamulaha eraygaaga sirta ah) waa in isla markaaba meesha laga saaraa, ama ugu yaraan waa in Gelitaanka Goobta laga xaddiday On all sites kuOn click.
15. Guji ** Ka saar *** beddele kasta oo PDF ah, VPN bilaash ah, soo dejiyaha fiidiyowga/MP3, kor u qaadka mugga, cursor-ka caadiga ah, beddelka-qaabka mugdiga ah, kuuban-hele, dhinaca AI, ama kordhinta ciyaarta aadan si adag ugu baahnayn.

Talaabada 2: Kormeer Fidinta manifest.json iyo Gaadiidka Shabakadda Tooska ah ka hor inta aan la saarin ( Kala soocida Forensic )¶

Haddii aad u baahan tahay inaad ogaato in kordhinta shakiga leh ay dhab ahaantii xaday furahaaga sirta ah ee shirkadda, cookies-ka fadhiga, ama furayaasha cryptocurrency ka hor intaadan tirtirin, qaado laba daqiiqo si aad u baadho faylalka deegaanka ee saxanka inta Wi-Fi-gaagu wali go'an yahay: 1. Nuqul ka samee 32-jilaa ID oo lagu muujiyay kaadhka kordhinta gudaha chrome://extensions. 2. U gudub browserka deegaankaaga Extensions galka diskka (oo ku taxan shaxda Talaabada 4 ee hoose) oo fur galka u dhigma aqoonsigaas 32 xaraf. 3. Fur manifest.json ku fayl gudaha galkaas adoo isticmaalaya Windows Notepad ama macOS TextEdit oo baar saddex goobood: - "permissions" iyo "host_permissions": Raadi ogolaanshaha khatarta sare leh oo ay ku jiraan "cookies", "webRequest", "declarativeNetRequest", "clipboardRead", "clipboardWrite", "scripting", "debugger", "proxy"iyo "<all_urls>". Kordhinta ku andacoonaysa inay tahay fudud "Toggle Mode Mode" ama "Codiyaha Codka" ee codsada "cookies" iyo "<all_urls>" Waxaa hubaal ah in la goosanayo kalfadhiyada login. - "content_scripts": Wuxuu muujiyaa faylalka JavaScript (content.js, inject.js) waxaa lagu duraa shabakad kasta oo aad booqato, oo ay ku jiraan bangiyada iyo marinnada boorsada crypto. - "background" ("service_worker"*: Wuxuu aqoonsadaa qoraalka asalka ah ee joogtada ah (background.js ama sw.js). Raadinta faylka JavaScript ee ku jira Notepad ee xargaha sida fetch(, XMLHttpRequest, WebSocket, navigator.clipboard, chrome.cookies.getAll, eth_sendTransaction, ama atob( waxay daaha ka qaadaysaa amarka iyo xakamaynta weerarka (C2) oo muujinaya sida saxda ah xogta la faafiyay.

Tallaabada 3: Hubi Afduubka Bartilmaameedka Gaaban ee browserka (--load-extension)¶

Xitaa ka dib markaad gujiso klzzwxh:0072). 2. Eeg sanduuqa Bartilmaeedka:** hoosta Shortcut tab. 3. Sanduuqa Bartilmaameedka nadiifka ah wuxuu ku dhamaanayaa si adag "chrome.exe" ama "msedge.exe": - **Nadiifi ***: "C:\Program Files\Google\Chrome\Application\chrome.exe" - ** LA QABTAY ***: "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\Public\Documents\ExtUpdater" https://search-hijack.com 4. Wax walba tirtir ka dib chrome.exe" (ama gabi ahaanba tirtir jidka gaaban oo si toos ah uga soo dheji jid-gaab cusub C:\Program Files\Google\Chrome\Application\chrome.exe).

Tallaabada 4: Ka Tirtir Faylasha Fidinta Hadhaaga iyo Shaqaalaha Adeegga Disk-ga¶

Hel tusaha astaanta guud ee biraawsarkaaga oo tirtir galka hoose ee u dhigma aqoonsiga 32-dabeecadood ee dheeraadka ah, iyo nadiifinta shaqaalaha adeegga ee diiwaangashan:

Ka dib markii la tirtiro galka kordhinta, fur chrome://serviceworker-internals (ama edge://serviceworker-internals) biraawsarkaaga oo guji Is-diiwaangelinta shaqaale kasta oo adeeg ah oo la xidhiidha kordhinta meesha laga saaray ama boggaga ogeysiinta riixitaanka ee aan la aqoon.

Talaabada 5: Nadiifi Oggolaanshaha Ogaysiinta Riix ee Rogue, Matoorada Raadinta ee La Afduubay, iyo Dejinta Proxy/DNS.¶

Fidinta adware badan iyo afduubayaasha browserka ayaa ka tagaya seddex dabin oo labaad xitaa ka dib marka binary-ga kordhinta la tirtiro: 1. Ka noqo Rukunka Ogeysiiska Riixitaanka Shabakadda xaasidnimada leh (Fake Antivirus Popups): - Haddii digniinaha fayraska ee McAfee, Norton, ama Windows Defender been abuur ah ay ku sii socdaan geeska hoose ee midig ee shaashaddaada mar kasta oo browserkaagu furmo, kuwani waa HTML5 Web Push Notifications oo ka socda goob aan fiicneyn oo aad si lama filaan ah u siisay oggolaansho ogeysiis ah. - Fur chrome://settings/content/notifications (ama edge://settings/content/notifications / about:preferences#privacy -> Ogolaanshaha -> Ogeysiisyada ** ee Firefox). - Hoos ugu dhaadhac liiska "La oggol yahay in la diro ogaysiisyada", dhagsii saddexda dhibcood ee ku xiga meel kasta oo aan la aqoon ama laga shakisan yahay, oo dhagsii saar ama ** xannibi. 2. Dib u dajinta Matoorka Raadinta ee Asalka ah ee La Afduubay & Bogagga Bilawga : - Fur chrome://settings/searchEngines (edge://settings/search) oo xaqiiji in mashiinka raadintaada asalka ah uu tilmaamayo Google-ka dhabta ah (google.com), DuckDuckGo, ama Bing halkii aad ka ahaan lahayd URL-ka-wareejin u eeg (search.yahoo.com/yhs/... ama find-results.net). Tirtir dhammaan makiinadaha raadinta ee aan la aqoonsan ee liiska ku jira. - Fur chrome://settings/onStartup (edge://settings/onStartup) oo hubi "Fur bog gaar ah ama bogag gaar ah": ka saar URL-yada bilawga ah ee aan la aqoon ee lagu duro adware. 3. ** Hubi wakiilka nidaamka la afduubay ama DNS sugan (DoHSettings: - Qaar ka mid ah kordhinta xaasidnimada leh iyo rakibayaasha adware ayaa habeeya qoraalka PAC (Proxy Auto-Config) script ama rogue ** DNS-over-HTTPS (DoH** Server-ka si ay u sii wadaan faragelinta taraafikada shabakadaada kadib kordhintu way dhammaatay. - Gudaha Chrome/Edge, aad chrome://settings/security -> u rog Isticmaal DNS aamin ah oo xaqiiji in lagu dejiyay adeeg bixiyahaaga hadda ama xaliye dadweyne oo aad aaminsan tahay (Cloudflare 1.1.1.1, Quad9 9.9.9.9, ama Google Public DNS), ma aha URL caado la yaab leh. - Kadib fur chrome://settings/system -> dhagsii ** Fur goobaha wakiillada kombuyutarka**, oo xaqiiji in "Isticmaal qoraalka dejinta" iyo "Isticmaal server wakiil" labaduba waa damiyeen OFF (haddii uusan u baahnayn loo-shaqeeyahaagu).

Marxaladda 2: Ka saarida "Maaraynta Ururkaaga" siyaasadaha ganacsi ee beenta ahExtensionInstallForcelist)¶

Haddii aad ku jirto ** kombayutarka guriga gaarka ah *** (maaha laptop-ka uu bixiyay loo-shaqeeyahaaga ama dugsiga) oo aadan riixi karin badhanka **saar *** batoonka kordhinta shakiga leh sababtoo ah waxay leedahay calaamad dhisme xafiis oo yar oo ku xigta iyo Chrome/Edge bandhigyada "Braawsarkaaga waxaa maamula ururkaaga", adware waxa uu nidaamkaaga hawlgalka ku duray xeerarka Siyaasadda Kooxda Ganacsiga beenta ah.

Tallaabada 1: Kormeer chrome://policy ama edge://policy¶

Nooca chrome://policy (ama edge://policy / about:policies ee Firefox) geli barta ciwaanka - Raadi magacyo siyaasadeed sida ExtensionInstallForcelist, ExtensionInstallAllowlist, ExtensionSettings, HomepageLocation, RestoreOnStartupURLs, ama DefaultSearchProviderSearchURL. - Tiirka ** Value** ee ku xiga ExtensionInstallForcelist waxay soo bandhigi doontaa aqoonsiga fidinta 32 xaraf ee fiditaanka malware iyo URL-ka cusub ee ay ka soo jiidanayso.

Talaabada 2: Ka saar Xeerarka Rogue Browser ee Daaqadaha (Amar sare oo degdeg ah)¶

Guriga gaarka ah ee Windows 10 ama Windows 11 PC waa in ** aan *** lahayn wax siyaasadaha browserka shirkadeed lagu dabaqay, dhagsii Start Menu, nooca cmd, midig-guji Amar degdeg ah, dooro Orod sida maamule, oo fuli amaradan si aad u tirtirto khariidadaha Chrome, Edge, iyo siyaasada geesinimada leh oo dib u cusboonaysii Siyaasada Kooxda:

reg delete "HKLM\SOFTWARE\Policies\Google\Chrome" /f
reg delete "HKCU\SOFTWARE\Policies\Google\Chrome" /f
reg delete "HKLM\SOFTWARE\Policies\Google\Update" /f
reg delete "HKCU\SOFTWARE\Policies\Google\Update" /f
reg delete "HKLM\SOFTWARE\WOW6432Node\Google\Enrollment" /f
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Edge" /f
reg delete "HKCU\SOFTWARE\Policies\Microsoft\Edge" /f
reg delete "HKLM\SOFTWARE\Policies\BraveSoftware\Brave" /f
reg delete "HKCU\SOFTWARE\Policies\BraveSoftware\Brave" /f
rmdir /s /q "%WinDir%\System32\GroupPolicy"
rmdir /s /q "%WinDir%\System32\GroupPolicyUsers"
gpupdate /force

Kadib socodsiinta amaradaas, ku noqo chrome://policy (ama edge://policy) oo dhagsii badhanka ** Dib u rar siyaasadaha *** ee ku yaal geeska sare ee bidix. Dhammaan siyaasadaha ganacsiga khasabka ah ayaa isla markaaba meesha ka bixi doona, oo badhanka **saar *** gudaha chrome://extensions furi doonaa.

Talaabada 3: Ka saar Xeerarka Rogue Browser & Profile-ka qaabaynta ee macOS¶

On macOS, afduubayaasha browserka waxay xoojiyaan siyaasadaha ganacsiga been abuurka ah iyagoo isticmaalaya laba hab: 1. Xogta Habaynta MacOS (MDM profiles) in isticmaalaha lagu khiyaaneeyey in lagu rakibo iyada oo loo marayo rakibaha Flash/video player been abuur ah, iyo 2. la maamulay plist faylalka doorbidida.

1. ** Hubi oo ka saar profiles-ku-habaynta macOS xaasidnimo ah**:
2. Fur ** Menu Apple -> Hababka Nidaamka -> Guud -> Maareynta Aaladda ** (macOS Monterey/Big Sur, fur ** Dookhyada Nidaamyada -> Profiles**).
3. Haddii aad ku jirto Mac-ga gaarka ah oo aad aragto ** mid kasta oo *** profile ku hoos qoran Maaraynta Aaladda/Profiles (badanaa lagu magacaabo "Chrome Settings", "SearchConfig", "AdminPrefs",ama "WeKnow"), dooro oo guji - (Ka saar) badhanka xagga hoose, ka dibna geli eraygaaga sirta ah ee Mac si aad u tirtirto.
4. ** Tirtir browserka la maamulay plist Faylasha iyada oo loo marayo macOS Terminal ***:
5. Fur ** Terminal** (Cmd + Space, nooca Terminal) oo maamul amarradan si aad qasab uga saarto plist faylasha siyaasadda oo nadiifi cfprefsd kayd:

sudo rm -f /Library/Managed\ Preferences/com.google.Chrome.plist
sudo rm -f /Library/Managed\ Preferences/*/com.google.Chrome.plist
sudo rm -f /Library/Preferences/com.google.Chrome.plist
rm -f ~/Library/Preferences/com.google.Chrome.plist
sudo rm -f /Library/Managed\ Preferences/com.microsoft.Edge.plist
sudo rm -f /Library/Preferences/com.microsoft.Edge.plist
defaults delete com.google.Chrome ExtensionInstallForcelist 2>/dev/null
defaults delete com.google.Chrome HomepageLocation 2>/dev/null
sudo killall cfprefsd

Dib u bilow Chrome/Edge oo ka xaqiiji chrome://policy in siyaasadaha eber ay yihiin kuwo firfircoon.

Wajiga 3: Ogaanshaha iyo Ciribtirka Heer OS-Crypto Clipboard Hijackers ("Clippers")¶

Ka waran haddii aad ka saarto browser kasta oo dheeraad ah, aad si buuxda u xidho biraawsarkaaga, oo aad tijaabiso koobiyaynta ciwaanka jeebka crypto (0x... ama bc1...) gudaha Windows Notepad ama macOS TextEdit, iyo ** ciwaanka la dhejiyay wali wuu isu beddelayaa ciwaanka jeebka weerarka**?

Taas macneheedu waxa weeye Heerka Operating System Clipper Malware binary (Laplas Clipper, ClipBanker, phemedrone, RedLine, ama script Python/Node/AutoIt) ayaa ka dhex shaqeeya gadaasha nidaamkaaga hawlgalka oo wacaya Windows AddClipboardFormatListener / SetClipboardData API (ama macOS NSPasteboard loop codbixinta).

Talaabada 1: Aqoonso Hanaanka Hadda Haysta ama Codaynta Kiliboodhkaga¶

• ** Daaqadaha (Nidaamka Tooska ah ee PowerShell & Hantidhawrka Bilowga)**: Fur PowerShell maamule ahaan oo socodsii amarkan ogaanshaha si aad u taxdo dhammaan hababka asalka ah ee aan Microsoft ahayn ee ka dhammaanaya hagaha la qori karo isticmaale (AppData, Temp, ProgramData, Users\Public) halka 99 boqolkiiba Clipper Trojans ay ku nool yihiin:

Get-CimInstance Win32_Process | Where-Object {
    $_.ExecutablePath -match "AppData|Temp|ProgramData|Users\\Public"
} | Select-Object ProcessId, Name, ExecutablePath, CommandLine | Format-List

Hubi wax soo saarka in laga shakiyo .exe, pythonw.exe, wscript.exe, cscript.exe, powershell.exe, mshta.exe, ama AutoIt3.exe geedi socodka ka baxaya %AppData%\Roaming, %LocalAppData%\Temp, ama C:\ProgramData. U fiirso ProcessId (PID) iyo ExecutablePath, ku jooji hawsha Stop-Process -Id <PID> -Force, oo tirtir binary-ga diskka.

• ** Hubi Goobaha Joogtada DaaqadahaRun Furayaasha & Scheduled Tasks***: Clippers waxay ku badbaadaan reboots iyagoo ku daraya Diiwaangelin Run fure, bilow .lnk gal shell:startup, ama hawl la qorsheeyay. Samee labadan hubin ee PowerShell si aad u muujiso:

Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run", "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
Get-ScheduledTask | Where-Object {$_.State -ne "Disabled" -and $_.Author -notmatch "Microsoft"} | Select-Object TaskName, TaskPath, State

Soo deji Microsoft Sysinternals Autoruns (Autoruns64.exe) ka learn.microsoft.com/en-us/sysinternals/downloads/autoruns, u socodsii maamule ahaan, karti u yeelo ** Options -> Scan Options -> Xaqiiji saxeexyada koodka + Hubi VirusTotal.com**, oo tirtir wax kasta oo guduudan/aan saxeexin oo ku jira Logon, Tasks Jadwaleysan, ama WMI tabs.

• ** MacOS (LaunchAgents & Audit Processor Background)**: Fur Terminal oo hubi dhammaan isticmaalayaasha iyo nidaamka LaunchAgents iyo LaunchDaemons (halkaasoo macOS clippers iyo Atomic Stealer / Poseidon Qoraallada adkeysiga ayaa qarinaya):

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons
ps aux | grep -E "osascript|python|node|curl|base64|NSPasteboard"

Kormeer wixii aan la aqoon .plist gal -/Library/LaunchAgents isticmaalaya cat -/Library/LaunchAgents/<filename>.plist, ku dejiso launchctl unload -/Library/LaunchAgents/<filename>.plist, oo tirtir labadaba .plist iyo binary-ga ay tilmaamayso.

Wajiga 4: Soo kabashada caabuqa kadib ( burinta cookies-ka fadhiga la xaday, OAuth tokens, iyo oggolaanshaha Web3)¶

Tirtiridda kordhinta biraawsarkaaga xaasidnimada leh waxay joojisaa basaasiinta mustaqbalka, laakin ma burinayso cookies-ka fadhiga, ereyada sirta ah ee la keydiyay, ama weedhaha abuur boorsada kordhinta horay loogu shubay serferka qofka wax weeraray markii la rakibay. Ka soo qaad tab kasta oo furnaa iyo erayga sirta ah ee lagu kaydiyay browserka maamulaha sirta ah ee ku dhex jira waa la jabsaday:

1. ** Ku qasbi caalami "ka bax dhammaan fadhiyada" xisaabaadkaaga xasaasiga ah ***:
2. **Beddelka furaha sirta ah mararka qaarkood waxay ka tagtaa calaamadaha OAuth ee jira ama fadhiyada mobilada/web-ka waxay shaqaynayaan ilaa saacad
   • *Google/Gmail: myaccount.google.com/device-activity -> dooro fadhi kasta oo aan la aqoon ama miiska miiska -> ** Saxiix ***. Sidoo kale iska hubi myaccount.google.com/permissions in la buriyo OAuth abka dhinac saddexaad
   • Microsoft / Muuqaalka / 365: account.live.com/proofs/manage/additional -> dhagsii ** iga Saxiix *** (waxay ku qasbeysaa ka bixida caalamiga ah dhammaan daalacashada 24 saac gudahood).
   • ** GitHub / GitLab / AWS / Consoles Cloud *: Tag github.com/settings/sessions -> ** Ka noqo dhammaan kulammada, oo beddel calaamad kasta oo gelitaanka Shakhsi ahaaneed (PATs) ama furayaasha SSH.
   • ** Discord / Slack / Social Media ***: Ogsoonow in kordhinta xaasidnimada leh ay si gaar ah u beegsanayaan Discord's Local Storage calaamada aqoonsiga iyo cookies Manager Business Facebook; Beddel eraygaaga sirta ah ee Discord (kaas oo si toos ah dib u soo nooleynaya calaamada isticmaalaha Discord) oo joojiya dhammaan fadhiyada firfircoon ee Facebook/Instagram Security Settings.
3. ** Haajiro Mid kasta oo Software Crypto Wallet (MetaMask, Phantom, Rabby, KeplrKaas Lagu Rakibay Isla Browser-ka**:
4. Hadday kordhin xaasidnimo lahayd <all_urls> ama scripting gelitaanka, ama haddii xog-ururinta heerka OS-ku ku socdo kombuyutarkaaga, waxaa laga yaabaa inuu akhriyay faylkaaga kaydka ah ee qarsoon (ldb faylasha gudaha Local Extension Settings) oo ay qabteen boorsadaada fur furka erayga sirta ah markaad wax ku qorayso.
5. ha lacagta ha ku haysan weedha jeebka ee kulul. Ku samee kelmad abuurka boorsada cusub ee qalabka nadiifka ah ama Wallet Hardware (Ledger, Trezor, Keystone, ku wareeji hantidaada harsan boorsada cusub, oo ka noqo ogolaanshaha calamada revoke.cash raacaya our Daadi boorsada lacagta cryptocurrency iyo weedha abuur hage tanaasul.
6. ** Samee Dib-u-dejin Buuxda *:
7. Tag chrome://settings/reset (edge://settings/reset / about:support -> * Cusbooneysii Firefox*) oo dhagsii ** Dib u soo celinta jaangooyooyinkoodii asalka ahaa **. Tani waxay dib u dajinaysaa boggaaga bilowga, bogga tab cusub, makiinadaha raadinta, iyo tabsiyada dhejiska ah, waxay nadiifisaa cookies-ka ku meel gaadhka ah, oo waxay curyaamisaa kordhin kasta oo hadhay.

Su'aalaha soo noqnoqda¶

Maxay tahay sababta kordhinta aan si badbaado leh u isticmaalay 2 sano si lama filaan ah ugu badashay malware ama adware?¶

Kordhinta browserka ayaa si toos ah iyo aamusnaan u cusboonaysiiya gadaasha iyada oo aan lagu waydiisan ogolaanshahaaga ilaa nooca cusubi uu codsado qayb cusub oo ogolaansho ah. Kooxaha dambiilayaasha internetka iyo xayaysiiska xayaysiiska waxay si joogto ah ula xidhiidhaan soosaarayaasha kali ah ee caanka ah, kordhinta sharciga ah (sida aaladaha PDF, kor u qaadayaasha mugga, duubayaasha shaashadda, ama xannibayaasha xayaysiisyada) waxayna siiyaan kumanaan doolar si ay u iibiyaan akoonkooda Soosaarayaasha Bakhaarka Mareegta Chrome ama wareejinta lahaanshaha kordhinta. Marka iibsaduhu uu xakameeyo liiska, waxay riixaan cusboonaysiinta nooca aamusan ee ka kooban tuugada buskudka ama koodhka afduubka ee xidhiidhka kaas oo waxyeeleeya isticmaale kasta oo jira habeen.

Cusboonaysiinta Google ee Manifest V3 miyuu ka dhigayaa kordhinta Chrome iyo Edge gabi ahaanba ka badbaado malware?¶

Maya xeerarka ku dhawaaqidaNetRequest. Xaddidaadda kordhinta kaliya kuwa aad si adag u aaminsan tahay iyo dejinta oggolaanshaha Gelitaanka Bogga ee "Dhammaan" waa muhiim.

Sideen uga ilaalin karaa xawaaladaha cryptocurrency-ga ee mustaqbalka?¶

Marka hore, waligaa ha xaqiijin kaliya 4-ta xaraf ee ugu horreeya iyo 4-ta xaraf ee u dambeeya ciwaanka boorsada la dhejiyay, sababtoo ah qalabka casriga ah ee casriga ah wuxuu isticmaalaa barkadaha ciwaanka aan waxba tarayn ee horay loo xisaabiyay si uu u soo qaato ciwaanka weerarka kaas oo wadaaga jilayaasha bilawga iyo dhamaadka ah ee la mid ah kan qaatahaaga; had iyo jeer hubi ugu yaraan 6da hore, 6da dhexe, iyo 6da xaraf ee ugu dambeeya. Marka labaad, isticmaal boorsada qalabka khadka ee khadka tooska ah (sida Ledger, Trezor, ama GridPlus) oo xaqiiji ciwaanka buuxa ee qalabka qalabka ka hor inta aanad riixin badhanka xaqiijinta, oo keydi ciwaannada qaataha inta badan la isticmaalo gudaha Buugga Cinwaanka ee liiska cad cad halkii aad ka koobi lahayd oo ku dhejin lahayd sabuuraddaada.

Ilaha la hubiyay¶

• Nabadgelyada internetka iyo Hay'adda Ammaanka KaabayaashaCISA, Mareykanka) & Xafiiska Baarista FederaalkaFBI): La-talinta Amniga Internetka ee Wadajirka ah ee ku saabsan Infostealer Malware, Afduubka Kukiyada Kalfadhiga, iyo Kordhinta Browser xaasidnimo.
• Machadka Heerarka iyo Tignoolajiyada Qaranka (NIST, Mareykanka): SP 800-83 Rev. 1, Hagaha Kahortagga iyo Kahortagga Dhacdooyinka Malware-ga ee Kombiyuutarada iyo Laabtoobyada.
• Shirkadda Google Chrome & Kooxda Amniga Chromium: Liiska Siyaasadda Ganacsiga ChromeExtensionInstallForcelist), Muuji V3 Qaabdhismeedka Amniga Fidinta, iyo Dib u hagaajinta duritaanka Siyaasadda Aan La Fasaxnayn.
• Xarunta Jawaabta ee Amniga Microsoft (MSRC& Difaacaha Microsoft Sirdoonka Hanjabaada: * Falanqaynta iyo Dib-u-heshiisiinta CrypToClipper Afduubaha Clipboard-ka Malware iyo Rogue Browser Policy Joogista Diiwangelinta (HKLM\SOFTWARE\Policies\Microsoft\Edge)*
• Xarunta Amniga Internetka ee QarankaNCSC, Boqortooyada Ingiriiska): Hagidda Amniga Qalabka: Maareynta Kordhinta Browser, Xakamaynta Siyaasadaha Ganacsiga, iyo Yaraynta Xatooyada Token.

Tilmaamaha la xidhiidha¶

• Daadi-daacinta jeebka Cryptocurrency, tanaasulka abuurka, iyo burinta oggolaanshaha
• Malware, ransomware, iyo spyware ka saarida caabuqa
• phishing-ka MFA, iska dhaafka-dhexe-dhexe (AiTM), iyo xatooyo buskud
• Jawaabta jebinta xogta, ereyada sirta ah ee soo daatay, iyo credits ayaa fariistay
• Nambarada degdega ah wadan ahaan