Keketso ea Sebatli se Lonya, Li-Hijacker tsa Crypto Clipboard, le Reset ea Sebatli¶

Ho hlokomela hore aterese ea sepache sa cryptocurrency (BTC, ETH, SOL, USDT) kapa banka ea IBAN/nomoro ea ho tsamaisa eo u sa tsoa qopitsa ka eona Ctrl+C (Cmd+C) e fetotse aterese ya motho eo o sa mo tsebeng hanghang ha o tobetsa Ctrl+V (Cmd+V), ho fumana hore katoloso ea Chrome, Edge, Brave, kapa Firefox eo u e kentseng lilemong tse fetileng ("PDF Converter", "Volume Booster", "Video Downloader", kapa "AI Assistant") e ile ea rekisoa ka sekhukhu ho mokhatlo oa lipapatso 'me joale e ntse e kenya lihokelo tse amanang le eona le ho kotula li-cookies tsa hau tsa thuto, kapa ho fumana enjine ea hau ea ho batla e notletsoeng leqepheng le koetsoeng le letlapa le tsamaisang litaba ka tlas'a molaetsa. Hobane libatli tsa sejoale-joale tsa marang-rang li boloka li-cookies tsa hau tse netefalitsoeng tsa Gmail, Microsoft 365, li-consoles tsa marang-rang, batsamaisi ba li-password, le li-wallet tsa Web3, katoloso e le 'ngoe e mpe e fanoeng. "Read and change all your data on all websites" (<all_urls> kapa *://*/* litumello tsa moamoheli) li feta Multi-Factor Authentication (MFA) ka ho felletseng ka ho bala likenyelletso tsa hau tsa DOM, likonopo, le navigator.clipboard buffer ka nako ea sebele.

Haeba ts'ebetso ea sebatli e tsamaisana le bosholu, litšokelo tsa 'mele, kapa ts'ebetso e ntseng e tsoela pele, letsetsa nomoro ea hau ea tšohanyetso ea lehae (911 United States le Canada, 112 ho pholletsa le European Union, 999 United Kingdom) kapa sheba bukana ea rona ea machaba dinomoro tsa tshohanyetso hanghang. Maemong ohle a katoloso e mpe ea sebatli, malware a crypto clipboard, kapa ho koeteloa ha leano la sebatli, etsa ts'ebetso ea ho tlosa le ho hlakola seshene ka tlase.

Etsa sena hona joale¶

1. **ETSA ho beha lintlha tsa bohlokoa (Ctrl+V / Cmd+V) 'me U SE KE UA lumella transaction ea cryptocurrency ntle le ho netefatsa litlhaku tse 6 LE tsa ho qetela tse 6 skrineng sa sepache sa hau sa hardware **: Clipboard hijacker malware ("Clippers" / CrypToClipper) e sebelisa lipolelo tse tloaelehileng (RegEx) ho beha leihlo sistimi ea hau ea ts'ebetso le clipboard ea sebatli ka metsotsoana e meng le e meng e 100. Hang ha u kopitsa a 0x... Aterese ea Ethereum, bc1... Aterese ea Bitcoin, kapa aterese ea Solana, e fetola litaba tsa clipboard ka aterese ea lefeela e kang ea mohlaseli.
2. Hakolla komporo e tšoaelitsoeng ho Wi-Fi / Ethernet pele e bula chrome://extensions (edge://extensions / about:addons): Likatoloso tse ngata tse lonya li shebelletse mosebelisi ha a ea ho li-extensions tabo mme ba koala tab ka bo bona, ba ipate, kapa ba tlohelle li-cookies tsa hau tse bulehileng pele o ka tobetsa **Tlosa **. Ho tima Wi-Fi pele ho fokotsa taelo le taolo ea bona (C2) mocha.
3. Tlosa "Extensions Sync" ho ak'haonte ea hau ea Google, Microsoft, kapa Mozilla PELE o hlakola katoloso e mpe: Haeba Chrome Sync, Edge Sync, kapa Firefox Sync e lumelletsoe, ho hlakola katoloso e mpe sebakeng sa heno ho laptop e le 'ngoe hangata ho hloleha hobane profil ea hau ea leru kapa komporo e ngoe e saenneng e khutlisetsa katoloso hape mochining oa hau kamora metsotsoana. Eya ho chrome://settings/syncSetup/advanced (edge://settings/profiles/sync) ebe o totobetsa Extensions ho ** OFF** pele.
4. **Rekota ID ea Katoloso ea litlhaku tse 32 (Developer Mode -> ID) ebe o hlakola katoloso LE ea sebakeng sa eona IndexedDB / Local Extension Settings foldara ho tsoa ho disk **: Pele o tobetsa **Tlosa **, bulela **Mokhoa oa Developer ** hukung e kaholimo ho le letona la chrome://extensions 'me u ngole ID ea litlhaku tse 32 (mohlala, aeblfdkhhhdcdjpifhhbdiojplfjncoa). Ho tseba hore ID e nepahetseng ho u fa monyetla oa ho netefatsa hore na katoloso e tšoailoe e le malware le ho hlakola foldara ea eona e setseng kahare ho sebaka sa heno. AppData / Library directory.
5. Hlakola melaoana ea sebatli sa fake ea khoebo (chrome://policy le edge://policy) tse reng "Sebatli sa hau se laoloa ke mokhatlo oa hau": Ho komporo ea hau ea lapeng, ho bona "E laoloa ke mokhatlo oa hau" e bolela adware kapa trojan e ngotse rogue ExtensionInstallForcelist kapa SearchProvider senotlolo ho Registry ea hau ea Windows (HKLM\SOFTWARE\Policies\Google\Chrome) kapa Li-profiles tsa tlhophiso ea macOS (System Settings -> General -> Device Management) kahoo o sitoa ho tobetsa konopo ea Tlosa.
6. Fetosa li-cookies tsohle tse utsoitsoeng tsa sebatli ka ho tobetsa "Tsoha ho linako tsohle" sesebelisoa se hloekileng: Hobane katoloso e mpe le <all_urls> tumello kapa chrome.cookies phihlello e se e kopitsitse li-tokens tsa hau tsa ho kena ka kotloloho, ho hlakola feela katoloso ha ho*** ho leleka mohlaseli liak'haonteng tsa hau. Sebelisa smartphone e hloekileng ho qobella Tsamaea ho Lisebelisoa Tsohle / Hlakola Session ho lengolo-tsoibila la hau, libanka, leru, le liakhaonto tsa sechaba, 'me u fetole li-password tsa hau ho latela rona. karabo ea tlolo ea data le tataiso ea ho lutla ha password.

Sefate sa liqeto: ho arola litšokelo tsa katoloso ea sebatli, linokoane tsa maano, le li-clippers tsa OS¶

Latela lethathamo lena la tlhahlobo ho tseba hore na ke karolo efe ea sebatli sa hau kapa sistimi ea ts'ebetso e senyehileng, 'me u felise mokhoa o sa fetoheng:

flowchart TD
    Start["Sebatli se Hlokomehileng se Fumaneha: Aterese ea Clipboard e Fetotsoe, Batla e tsamaisitsoe bocha, Rogue Popups, kapa Account Session Stolen"] --> Test{"1. Koala Sebatli ka ho Fetisisa & Kopitsa/Beha Aterese ea Crypto ho Notepad / TextEdit: Na e ea Fetoha?"}
    Test -->|"E: Aterese e Fetola Sebatli se Ntle"| OSClip["OS-LEVEL CLIPPER MALWARE: Kill Rogue Process ho Task Manager, Hlakola Mesebetsi e Reriloeng / Matha Linotlolo 'me u Mathe AV Scan ea Offline"]
    Test -->|"Che: E Etsahala Feela Ka hare ho Sebatli"| PolicyCheck{"2. Bula chrome://policy or edge://policy: Na Maano a thathamisitsoe ho PC ea Hau ea Lehae?"}
    PolicyCheck -->|"E: 'E laoloa ke mokhatlo oa hau' / ExtensionInstallForcelist"| WipePolicy["Hlakola linotlolo tsa Leano la Registry la Rogue Windows (Maano a HKLM/HKCU) kapa Tlosa Profaele ea Tlhophiso ea macOS"]
    PolicyCheck -->|"Ha ho Maano a Fumanehang"| ExtAudit["3. Tlosa Sync -> Numella Mokhoa oa Moetsi ho chrome://extensions -> Tseba le ho Tlosa Keketso e Senyehileng."]
    WipePolicy --> ExtAudit
    OSClip --> ExtAudit
    ExtAudit --> DiskWipe["4. Hlakola Lifoldara tsa Katoloso ea Masala, Basebeletsi ba Litšebeletso & Cache ea IndexedDB ho Directory ea Local User Profile Directory."]
    DiskWipe --> CookieRevoke["5. Ho Tloha ho Sesebelisoa se Hloekileng: Hlakola Lisebelisoa Tsohle Tse Tsoang (Google, Microsoft, GitHub, Banks) & Hlahloba Litumello tsa Crypto"]

Kamoo li-extensions tse nepahetseng tsa sebatli li fetohang hampe ka bosiu bo le bong (le mefuta e 5 ea tlhaselo)¶

Ho feta liperesente tse 70 tsa bahlaseluoa ba tšoaelitsoeng ke li-extensions tse mpe tsa sebatli ha ho mohla ba kileng ba tobetsa sehokelo sa software se senyehileng: ba kentse katoloso e tloaelehileng, e nang le maemo a holimo ka kotloloho ho tsoa ho semmuso ** Lebenkele la Webo la Chrome , ** Lebenkele la Li-add-ons la Microsoft Edge, kapa Firefox Add-ons (AMO) likhoeli kapa lilemo pejana. Li-Cybercriminals li sekisetsa katoloso ka mekhoa e 'meli ea phepelo ea thepa: **1. Katoloso ea Katoloso ea Katoloso / Ts'ebetso ea Chelete ** (moo mohlaseli a fang moqapi ea ikemetseng $5,000 ho isa ho $50,000 chelete ho reka beng ba katoloso e tsebahalang ea basebelisi ba 100,000, ebe o sutumelletsa ntlafatso e khutsitseng e nang le malware e sa bonahaleng eo sebatli se seng le se seng se se jarollang ka morao); le 2. Moetsi oa OAuth Phishing (moo bahlaseli ba qhekellang ak'haonte e molaong ea moetsi oa Lebenkele la Web la Chrome, joalo ka ha ho etsahetse litlolong tse kholo tse amang likhoebo tse ngata le likatoloso tsa ts'ireletso).

Mokhahlelo oa 1: Mokhoa oa ho hlahloba, ho tseba, le ho tlosa likeketso tse mpe ho Chrome, Edge, Brave, Firefox le Safari¶

Se ke oa sheba feela litšoantšo tse haufi le bara ea aterese ea hau: li-extensions tse lonya li pata letšoao la bona la lithulusi ka boomo (Action konopo e patiloeng) kapa u ikopanye ka ho sebelisa letšoao le lebitso le nepahetseng la Google Docs Offline, Google Translate, uBlock Origin, kapa Adobe Acrobat.

Mohato oa 1: Hlahlobisisa li-extensions tsa hau tse kentsoeng 'me u nke ID ea Litlhaku tse 32¶

1. Hakolla komporo ea hau ho Wi-Fi / Ethernet kahoo ha ho na katoloso e ka fetisang phallo ea ho qetela ea data kapa ho inchafatsa ha u ntse u e hlahloba.
2. Bula khomphutha ea kahare ea taolo ea sebatli sa hau ka ho ngola URI e nepahetseng ka har'a bara ea liaterese:
3. Google Chrome: chrome://extensions
4. Microsoft Edge: edge://extensions
5. Sebatli se Sebete: brave://extensions
6. Mozilla Firefox: about:addons (mme hape thaepa about:debugging#/runtime/this-firefox ho bona litlatsetso tsa nakoana/tse patiloeng)
7. Apple Safari (macOS): Safari -> Settings (Cmd + ,) -> Extensions
8. ** Bulela "Mokhoa oa Moetsi"** (totolla swichi hukung e kaholimo ho le letona la Chrome, Edge, le Brave).
9. Ho bulela Mokhoa oa Moetsi ho senola lintlha tsa bohlokoa tsa forensic kareteng e 'ngoe le e 'ngoe ea katoloso:
10. ID: Mohala o ikhethileng oa litlhaku tse 32 (joalo ka cjpalhdlnbpafiamejdnhcphjbkeiagm).
11. Inspect views: service worker / background page: E bonts'a hore na katoloso e ntse e sebelisa sengoloa sa bokamorao hona joale.
12. Source: Installed by enterprise policy kapa Loaded from: C:\Users\... (Katoloso e sa Lebelloang): Ntle le haeba u le moqapi oa software ea ngotseng katoloso ka bo uena, ** ha ho na katoloso e nepahetseng ea bareki e lokelang ho bua. Loaded from: [Folder Path] (keketso e sa Pakiloeng)**. Bangoli ba Malware ba kenya ka thoko li-extensions tse sa patoang ho tsoa tse patiloeng AppData kapa ProgramData li-folders ka ho fetola li-shortcut (chrome.exe --load-extension="C:\...") ho feta sekena sa tshireletso sa Lebenkele la Webo la Chrome ka botlalo.
13. Sheba katoloso e ngoe le e ngoe khahlano le Mekhoa ena ea ho Tlosa:
14. Tobetsa Lintlha -> Litumello (Site access) katolosong e 'ngoe le e 'ngoe. Katoloso efe kapa efe e nang le On all sites (Read and change all your data on all websites) seo e seng sesebelisoa sa ts'ireletso sa mohloli o bulehileng se ka tšeptjoang ka botebo (joalo ka molaoli oa hau oa mantlha oa li-password) se lokela ho tlosoa hang-hang, kapa bonyane se be le Sebaka sa ho kena se thibetsoeng On all sites ho On click.
15. Tobetsa **Tlosa ** ho converter efe kapa efe ea PDF, VPN ea mahala, video/MP3 downloader, booster volume, custom cursor, dark-mode toggle, coupon finder, AI sidebar, kapa katoloso ea papali eo u sa e hlokeng ka thata.

Mohato oa 2: Hlahloba katoloso ea manifest.json le Live Network Traffic Pele e Tlosoa (Forensic Triage)¶

Haeba o hloka ho tseba hore na katoloso e belaetsang e hlile e utsoitse li-password tsa hau tsa khoebo, li-cookies, kapa linotlolo tsa cryptocurrency pele u e hlakola, nka metsotso e 'meli ho hlahloba lifaele tsa eona tsa lehae ho disk ha Wi-Fi ea hau e ntse e khaotsoe: 1. Kopitsa litlhaku tse 32 ID e bonts'itsoeng kareteng ea katoloso ho chrome://extensions. 2. E ea sebakeng sa hau sa marang-rang Extensions foldara ho disk (e thathamisitsoeng tafoleng ho Mohato oa 4 ka tlase) ebe u bula foldara e ts'oanang le ID ea litlhaku tse 32. 3. Bula manifest.json faele ka har'a foldara eo u sebelisa Windows Notepad kapa macOS TextEdit 'me u hlahlobe likarolo tse tharo: - "permissions" le "host_permissions": Batla litumello tse kotsing e kholo ho kenyelletsa "cookies", "webRequest", "declarativeNetRequest", "clipboardRead", "clipboardWrite", "scripting", "debugger", "proxy", le "<all_urls>". Katoloso e reng ke "Dark Mode Toggle" e bonolo kapa "Volume Booster" e kopang. "cookies" le "<all_urls>" e batla e kotula linako tsa ho kena. - "content_scripts": E bonts'a lifaele tsa JavaScript (content.js, inject.js) li kentsoe leqepheng le leng le le leng la webo leo u le etelang, ho kenyeletsoa li-portal tsa bank le crypto wallet. - "background" ("service_worker"): E hlwaya script e phehellang (background.js kapa sw.js). Ho batla faele ea JavaScript ho Notepad bakeng sa likhoele tse kang fetch(, XMLHttpRequest, WebSocket, navigator.clipboard, chrome.cookies.getAll, eth_sendTransaction, kapa atob( e senola taelo le taolo ea mohlaseli (C2) domain name mme e bonts'a hantle hore na data e hlakisitsoe eng.

Mohato oa 3: Sheba Tsela e Khaotsang ea Sebatli (--load-extension)¶

Esita le ka mor'a hore u tobetse Tlosa ** ka hare chrome://extensions, mokhoa o tloaelehileng oa trojan o fetola setšoantšo sa sekhechana sa "desktop" le "taskbar" eo u e tobetsang ho qala Chrome, Edge, kapa Brave e le hore e itjalle ka bo eona keketso e patiloeng e mpe e sa buloang nako le nako ha u bula sebatli. - Ho Windows: 1. Tobetsa ka ho le letona setšoantšong sa hau sa Google Chrome / Microsoftdge / Bve ** ho Desktop eaau ('me u tobetse ka ho le letona setšoantšong se ho Taskbar ea hau -> tobetsa lebitso la sebatli hape -> tobetsa Propties ). 2. Sha lebokose la Target: tlas'a ** Shortcut tab. 3. Lebokose le hloekileng la Maikemisetso le fella hantle ka "chrome.exe" kapa "msedge.exe": - HLOKA: "C:\Program Files\Google\Chrome\Application\chrome.exe" - E KOPITSOE: "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\Public\Documents\ExtUpdater" https://search-hijack.com 4. Hlakola tsohle ka mor'a moo chrome.exe" (kapa hlakola tsela e khaoletsang ka ho felletseng ebe o tobetsa tsela e khaoletsang e ncha ka kotloloho ho tsoa ho C:\Program Files\Google\Chrome\Application\chrome.exe).

Mohato oa 4: Tlosa Lifaele tsa Katoloso e setseng le Basebeletsi ba Ts'ebeletso ho Disk¶

Fumana bukana ea profaele ea lehae ea sebatli 'me u hlakole foldara e ts'oanang le ID ea litlhaku tse 32, hammoho le ho hlakola basebetsi ba ngolisitsoeng ba litšebeletso:

Kamora ho hlakola foldara ea katoloso, bula chrome://serviceworker-internals (kapa edge://serviceworker-internals) ho sebatli sa hau ebe o tobetsa Tlosa ngoliso ho mosebeletsi leha e le ofe oa litšebeletso ea amanang le katoloso e tlositsoeng kapa libaka tse sa tloaelehang tsa tsebiso ea push-notification.

Mohato oa 5: Hlakola Litumello tsa Tsebiso ea Rogue Push, Lienjineri tsa Patlo tse Hijacked, le Litlhophiso tse Lonya tsa Proxy / DNS¶

Likatoloso tse ngata tsa adware le bosholu ba sebatli ba siea maraba a mararo a bobeli le kamora hore binary e tlosoe: 1. Hlakola Lipeeletso tsa Litsebiso tse Mpe tsa Web Push (Fake Antivirus Popups): - Haeba litemoso tsa fake McAfee, Norton, kapa Windows Defender ka vaerase li lula li hlaha hukung e ka tlase letsohong le letona la skrini ea hau neng kapa neng ha sebatli sa hau se butsoe, tseo ke HTML5 Web Push Notifications ho tsoa sebakeng sa marang-rang seo u se fileng tumello ka phoso. - Bula chrome://settings/content/notifications (kapa edge://settings/content/notifications / **about:preferences#privacy -> Litumello -> Litsebiso ** ho Firefox). - Tsamaisetsa tlase lethathamong la "Lumeletsoe ho romela litsebiso", tobetsa matheba a mararo haufi le sebaka se seng le se seng seo u sa se tsebeng kapa se belaetsang, ebe u tobetsa Tlosa ** kapa Thibela. 2. Seta bocha Enjine ea ho Batlisisa e Kgethiloeng le Maqephe a Qalo: - Bula chrome://settings/searchEngines(edge://settings/search) 'me u netefatse hore mochine oa hau oa ho batla oa kamehla o supa ho Google ea sebele (google.com), DuckDuckGo, kapa Bing ho fapana le URL e tsamaisang sebaka se tšoanang (search.yahoo.com/yhs/... kapa find-results.net). Hlakola lienjineri tsohle tse sa tsejoeng lenaneng. - Bula chrome://settings/onStartup(edge://settings/onStartup) 'me u hlahlobe "Bula leqephe le itseng kapa sete ea maqephe": tlosa li-URL tse sa tloaelehang tsa ho qala tse kentsoeng ke adware. 3. Sheba Proxy ea Sisteme e Koetsoeng kapa DNS e Sireletsehileng (DoH) Litlhophiso: - Likatoloso tse ling tse lonya le tse kenyang lipapatso li lokisa mongolo oa lehae oa PAC (Proxy Auto-Config) kapa o rogue DNS-over-HTTPS (DoH) seva hore ba tsoelepele ho thibela sephethephethe sa hau sa marang-rang ka mor'a hore katoloso e felile. - Ho Chrome/Edge, e ea ho chrome://settings/security -> tsamaisetsa ho Sebedisa DNS e bolokehileng mme o netefatse hore e hlophisitswe ho mofani wa hao wa ditshebeletso wa hajwale kapa mothapolli o tshepehang wa setjhaba (Cloudflare 1.1.1.1, Quad9 9.9.9.9, kapa Google Public DNS), eseng URL ea tloaelo e makatsang. - Ebe u bula chrome://settings/system -> tobetsa Bula litlhophiso tsa proxy tskomporo ea hau , 'me u netefatse hore **"belisa mongolo oa ho seta" le "Sebelisa seva ea moemeli" ka bobeli li tingoa TLOA (ntle le haeba u laetsoe ke mohiri oa hau).

Mokhahlelo oa 2: Ho tlosa maano a khoebo a "Laoloang ke mokhatlo oa hau" (ExtensionInstallForcelist)¶

Haeba u sebelisa khomphutha ea lapeng (eseng laptop e fanoeng ke mohiri kapa sekolo) 'me u ke ke ua tobetsa konopo ea Tlosa katolosong e belaetsang hobane e na le letšoao le lenyenyane la moaho oa liofisi haufi le eona le lipontšo tsa Chrome/Edge "Sebatli sa hau se laoloa ke mokhatlo oa hau", adware e kentse melao ea Leano la Leano la Khoebo la fake tsamaisong ea hau ea ts'ebetso.

Mohato oa 1: Hlahloba chrome://policy kapa edge://policy¶

Mofuta chrome://policy (kapa edge://policy / about:policies ho Firefox) sebakeng sa aterese ea hau. - Batla mabitso a leano joalo ka ExtensionInstallForcelist, ExtensionInstallAllowlist, ExtensionSettings, HomepageLocation, RestoreOnStartupURLs, kapa DefaultSearchProviderSearchURL. - Kholo ea Boleng haufi le ExtensionInstallForcelist e tla hlahisa ID ea Katoloso ea litlhaku tse 32 ea katoloso ea malware le URL ea ntlafatso eo e e hulang ho eona.

Mohato oa 2: Tlosa Melao ea Sebatli sa Rogue ho Windows (Elevated Command Prompt)¶

Lapeng la hau Windows 10 kapa Windows 11 PC e sa lokelang eseng ho sebelisa melaoana ea sebatli sa khoebo, tobetsa Start Menu, thaepa cmd, tobetsa ka ho le letona Command Prompt, khetha Matha joalo ka molaoli, 'me u phethe litaelo tsena ho hlakola Chrome, Edge, le mehala ea ngoliso ea leano la Brave le ho khatholla Leano la Sehlopha:

reg delete "HKLM\SOFTWARE\Policies\Google\Chrome" /f
reg delete "HKCU\SOFTWARE\Policies\Google\Chrome" /f
reg delete "HKLM\SOFTWARE\Policies\Google\Update" /f
reg delete "HKCU\SOFTWARE\Policies\Google\Update" /f
reg delete "HKLM\SOFTWARE\WOW6432Node\Google\Enrollment" /f
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Edge" /f
reg delete "HKCU\SOFTWARE\Policies\Microsoft\Edge" /f
reg delete "HKLM\SOFTWARE\Policies\BraveSoftware\Brave" /f
reg delete "HKCU\SOFTWARE\Policies\BraveSoftware\Brave" /f
rmdir /s /q "%WinDir%\System32\GroupPolicy"
rmdir /s /q "%WinDir%\System32\GroupPolicyUsers"
gpupdate /force

Kamora ho tsamaisa litaelo tseo, khutlela ho chrome://policy (kapa edge://policy) ebe o tobetsa konopo ea Khoasolla maano hukung e kaholimo ho le letšehali. Melao eohle e qobelloang ea likhoebo e tla nyamela hang-hang, 'me konopo ea Tlosa e kene chrome://extensions e tla notlolla.

Hata 3: Tlosa Leano la Sebatli sa Rogue le Li-profaele tsa Tlhophiso ho macOS¶

Ho macOS, masholu a sebatli a sebelisa maano a khoebo a seng molaong a sebelisa mekhoa e 'meli: 1. Lifaele tsa tlhophiso ea macOS (MDM profiles) eo mosebelisi a ileng a qhekelloa hore a e kenye ka mochini o kenyang Flash/video player, le **2. E laoloa plist Lifaele tse khethiloeng **.

1. Sheba le ho Tlosa Li-profaele tsa tlhophiso e mpe ea macOS:
2. Bula ** Apple Menu -> Litlhophiso tsa Sistimi -> Kakaretso -> Tsamaiso ea Sesebelisoa ** (ho macOS ea khale Monterey/Big Sur, bula ** Likhetho tsa Tsamaiso -> Liprofaele **).
3. Haeba u ho Mac 'me u bona profaele efe kapa efe e thathamisitsoeng tlas'a Tsamaiso ea Sesebelisoa/Profiles (hangata e bitsoa "Chrome Settings", "SearchConfig", "AdminPrefs", kapa "WeKnow"), e khethe ebe u tobetsa - (Tlosa) konopo e ka tlase, ebe u kenya phasewete ea hau ea Mac ho e hlakola.
4. Hlakola Sebatli se Laoloang plist Lifaele ka MacOS Terminal:
5. Bula Theminale (Cmd + Space, mofuta Terminal) ebe o tsamaisa litaelo tsena ho tlosa ho qobelloa plist leano difaele le ho hlakola le cfprefsd cache:

sudo rm -f /Library/Managed\ Preferences/com.google.Chrome.plist
sudo rm -f /Library/Managed\ Preferences/*/com.google.Chrome.plist
sudo rm -f /Library/Preferences/com.google.Chrome.plist
rm -f ~/Library/Preferences/com.google.Chrome.plist
sudo rm -f /Library/Managed\ Preferences/com.microsoft.Edge.plist
sudo rm -f /Library/Preferences/com.microsoft.Edge.plist
defaults delete com.google.Chrome ExtensionInstallForcelist 2>/dev/null
defaults delete com.google.Chrome HomepageLocation 2>/dev/null
sudo killall cfprefsd

Qala Chrome/Edge bocha 'me u netefatse ho chrome://policy hore maano a zero a lule a sebetsa.

Mokhahlelo oa 3: Ho lemoha le ho felisa Bahatelli ba Crypto Clipboard ba boemo ba OS ("Clippers").¶

Ho thoe'ng haeba u tlositse katoloso e 'ngoe le e' ngoe ea sebatli, u koala sebatli sa hau ka botlalo, 'me u leke ho kopitsa aterese ea sepache sa crypto (0x... kapa bc1...) ka hare ho Windows Notepad kapa macOS TextEdit, le **aterese e pakiloeng e ntse e fetoha aterese ea sepache sa mohlaseli **?

Seo se bolela mosebetsi oa boemo ba Clipper Malware binary (Laplas Clipper, ClipBanker, phemedrone, RedLine, kapa Python/Node/AutoIt script) e sebetsa ka morao ho sistimi ea hau ea ts'ebetso mme e bitsa Windows. AddClipboardFormatListener / SetClipboardData API (kapa macOS NSPasteboard poling loop).

Mohato oa 1: Tseba hore na Hajoale Ke Ts'ebetso Efe e Ts'oereng kapa e Khethang Clipboard ea hau¶

• Ho Windows (PowerShell Live Process & Startup Audit): Bula PowerShell e le Mookameli 'me u tsamaise taelo ena ea tlhahlobo ho thathamisa lits'ebetso tsohle tsa morao-rao tseo e seng tsa Microsoft tse felloang ke li-directory tse ngoloang ke basebelisi (AppData, Temp, ProgramData, Users\Public) moo karolo ea 99 lekholong ea Clipper Trojans e phelang teng:

Get-CimInstance Win32_Process | Where-Object {
    $_.ExecutablePath -match "AppData|Temp|ProgramData|Users\\Public"
} | Select-Object ProcessId, Name, ExecutablePath, CommandLine | Format-List

Sheba tlhahiso bakeng sa pelaelo .exe, pythonw.exe, wscript.exe, cscript.exe, powershell.exe, mshta.exe, kapa AutoIt3.exe lits'ebetso tse felang %AppData%\Roaming, %LocalAppData%\Temp, kapa C:\ProgramData. Hlokomela ProcessId (PID) le ExecutablePath, felisa tshebetso ka Stop-Process -Id <PID> -Force, 'me u hlakole binary ho disk.

• Hlahloba Libaka tsa Phehello tsa Windows (Run Linotlolo & Scheduled Tasks): Li-Clippers li pholoha ho qala bocha ka ho eketsa Registry Run senotlolo, ho qala .lnk faele ka shell:startup, kapa Mosebetsi o Reriloeng. Etsa licheke tsena tse peli tsa PowerShell ho li pepesa:

Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run", "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
Get-ScheduledTask | Where-Object {$_.State -ne "Disabled" -and $_.Author -notmatch "Microsoft"} | Select-Object TaskName, TaskPath, State

Khoasolla Microsoft Sysinternals Autoruns (Autoruns64.exe) ho tloha learn.microsoft.com/en-us/sysinternals/downloads/autoruns, e tsamaise joalo ka Mookameli, etsa hore Likhetho -> Likhetho tsa Skena -> Netefatsa li-signature tsa khoutu + Hlahloba VirusTotal.com, 'me u hlakole kenyo efe kapa efe e khubelu/e sa saenang ho li-tab tsa Logon, Mesebetsi e Reriloeng, kapa WMI.

• Ho macOS (LaunchAgents & Background process Audit): Bula ** Terminal ** 'me u hlahlobe basebelisi bohle le sistimi LaunchAgents le LaunchDaemons (moo li-clippers tsa macOS le Atomic Stealer / Poseidon persistence scripts pata):

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons
ps aux | grep -E "osascript|python|node|curl|base64|NSPasteboard"

Hlahloba leha e le efe eo u sa e tsebeng .plist faele ka -/Library/LaunchAgents tshebediso cat -/Library/LaunchAgents/<filename>.plist, e laolle ka launchctl unload -/Library/LaunchAgents/<filename>.plist, le ho hlakola bobeli ba .plist le binary eo e e supang.

Mokhahlelo oa 4: Ho hlaphoheloa ka mor'a ts'oaetso (ho hlakola li-cookie tse utsoitsoeng, li-tokens tsa OAuth, le tumello ea Web3)¶

Ho phumula sebatli se kotsi ho emisa ho phenya-phenngoa nakong e tlang, empa ha ho thibele li-cookies tsa lenaneo, li-password tse bolokiloeng, kapa mantsoe a peo ea wallet, atoloso e seng e kentsoe ho seva ea mohlaseli ha e ntse e kentsoe. Nka hore tab e 'ngoe le e' ngoe e neng e butsoe 'me senotlolo se seng le se seng se bolokiloeng ka har'a mookameli oa password ea sebatli se senyehile:

1. Hatella "Ho Tsoa Likhau Tsohle" Lefatšeng ka Bophara ho Liakhaonto Tsa Hao Tse Bohlokoa:
2. Ho fetola phasewete ka linako tse ling ho siea li-tokens tse seng li ntse li le teng tsa OAuth kapa li-mobile/web sessions li sebetsa ho fihlela hora. Kena ka sesebediswa se hloekileng ebe u tobetsa ka ho hlaka Tšoa ho Lithuto Tsohle / Hlakola Lisebelisoa Tsohle:
   • Google / Gmail: myaccount.google.com/device-activity -> khetha karolo e 'ngoe le e 'ngoe e sa tloaelehang kapa ea komporo -> ** Tsoa **. Hape hlahloba myaccount.google.com/permissions ho hlakola lits'ebetso tsa motho oa boraro oa OAuth.
   • Microsoft / Outlook / 365: account.live.com/proofs/manage/additional -> tobetsa Ntokolle (e qobella ho tsoa lefatšeng ka bophara ho libatli tsohle nakong ea lihora tse 24).
   • GitHub / GitLab / AWS / Cloud Consoles: Eya ho github.com/settings/sessions -> ** Hlakola linako tsohle **, 'me u fetole li-Tokens tsa phihlello ea hau (PATs) kapa linotlolo tsa SSH.
   • Discord / Slack / Social Media: Hlokomela hore likeketso tse mpe li shebane haholo le tsa Discord. Local Storage letshwao la netefatso le li-cookies tsa Motsamaisi oa Khoebo oa Facebook; fetola phasewete ea hau ea Discord (e nchafatsang lets'oao la hau la mosebelisi oa Discord ka bo eona) 'me u felise linako tsohle tse sebetsang ho Facebook/Instagram Security Settings.
3. **Sutha Software efe kapa efe Crypto Wallet (MetaMask, Phantom, Rabby, Keplr) E Kentsoeng ho Sebatli se le seng **:
4. Haeba keketso e mpe e bile le <all_urls> kapa scripting phihlello, kapa haeba infostealer ea boemo ba OS e ne e sebetsa ho komporo ea hau, e kanna ea ba e balile faele ea hau e kentsoeng ea vault (ldb lifaele ka Local Extension Settings) ebe o hapa phasewete ea ho notlolla sepache ha u ntse u e ngola.
5. U se ke ua** boloka chelete ka har'a poleloana ea peo ea sepache se chesang. Hlahisa poleloana e ncha ea peo ea sepache ho ** sesebelisoa se hloekileng kapa Hardware Wallet (Ledger, Trezor, Keystone)**, fetisetsa thepa ea hau e setseng sepacheng se secha, 'me u hlakole litumello tse leketlileng ho revoke.cash ho latela tsa rona cryptocurrency sepache drain le peo poleloana compromise guide.
6. Etsa ho Fetolela Sebatli bocha:
7. Eya ho chrome://settings/reset (edge://settings/reset / about:support -> * Nchafatsa Firefox*) ebe u tobetsa ** Khutlisa litlhophiso ho li-default tsa tsona tsa mantlha **. Sena se hlophisa bocha leqephe la hau la ho qala, leqephe le lecha la li-tab, mochini oa ho batla, le li-tabo tse hatisitsoeng, se hlakola li-cookies tsa nakoana, 'me se tima litlatsetso life kapa life tse setseng.

Lipotso tse botsoang khafetsa¶

Hobaneng ha katoloso eo ke e sebelisitseng ka polokeho bakeng sa lilemo tse 2 ka tšohanyetso e fetohile malware kapa adware?¶

Likatoloso tsa sebatli li intlafatsa ka mokhoa o iketsang 'me li khutsitse ka morao ntle le haeba mofuta o mocha o kopa sehlopha se secha sa tumello. Lihlopha tsa botlokotsebe ba marang-rang le mekhatlo ea bomenemene ea lipapatso khafetsa li ikopanya le baqapi ba li-extensions tse tsebahalang, tse molaong (joalo ka lisebelisoa tsa PDF, li-volume booster, lirekoto tsa skrineng, kapa li-ad blockers) 'me ba ba fe lidolara tse likete ho rekisa ak'haonte ea bona ea Chrome Web Store kapa ho fetisetsa mong'a katoloso. Hang ha moreki a laola lethathamo, ba sutumelletsa ntlafatso ea mofuta o khutsitseng e nang le bosholu ba li-cookie kapa khoutu ea bosholu e tšoaetsang mosebelisi e mong le e mong ea teng ka bosiu bo le bong.

Na ntlafatso ea Manifest V3 ea Google e etsa hore li-extensions tsa Chrome le Edge li sireletsehe ka botlalo ho malware?¶

Che. Le hoja Manifest V3 e ntlafatsa haholo ts'ireletso ka ho thibela li-extensions ho kenya khoutu ea JavaScript e sebetsang ka thōko ho tloha ho li-server tsa ka ntle (ho qobella khoutu eohle hore e bokelloe ka har'a sephutheloana sa katoloso se rometsoeng lebenkeleng), li-extensions tse lonya tse hlophisitsoeng tlas'a Manifest V3 li ntse li ka sebelisa hampe tumello ea moamoheli (Liwebsaeteng tsohle), bala li-cookies tsa DOM le li-keystrokes, ho qhekella li-cookies, ho qhekella, le clipboard. melaoana ea declarativeNetRequest. Ho beha moeli oa likeketso ho bao u ba tšepang ka tieo le ho beha tumello ea bona ea "Site Access" ho "On Click" ho fapana le "Liwebsaeteng tsohle" ho ntse ho le bohlokoa.

Nka sireletsa phetisetso ea ka ea li-cryptocurrensets joang ho "clipboard hijacker malware" nakong e tlang?¶

Ntlha ea pele, le ka mohla u se ke ua netefatsa litlhaku tsa pele tse 4 le tsa ho qetela tse 4 tsa aterese ea sepache, hobane malware a sejoale-joale a clipper a sebelisa matamo a liaterese tsa lefeela ho khetha aterese ea mohlaseli e arolelanang litlhaku tse qalang le tse qetellang joalo ka moamoheli oa hau; kamehla hlahloba bonyane litlhaku tsa pele tse 6, tse 6, le tse 6 tsa ho qetela. Taba ea bobeli, sebelisa Hardware Wallet e kantle ho marang-rang e nang le skrine ea 'mele (joalo ka Ledger, Trezor, kapa GridPlus) 'me u netefatse aterese e felletseng ea moamoheli skrineng sa sesebelisoa sa Hardware pele o tobetsa konopo ea netefatso ea' mele, 'me u boloke liaterese tsa moamoheli tse sebelisoang khafetsa ka har'a Buka ea Liaterese ea sepache sa hau ho e-na le ho li kopitsa le ho li manamisa ho clipboard ea hau.

Mehloli e hlahlobiloe¶

• Cybersecurity and Infrastructure Security Agency (CISA, United States) & Federal Bureau of Investigation (FBI): Likeletso tse Kopanetsoeng tsa Cybersecurity mabapi le Infostealer Malware, Session Cookie Hijacking, le Keketso ea Sebatli se Lonya.
• Setsi sa Naha sa Maemo le Thekenoloji (NIST, United States): SP 800-83 Rev. 1, Tataiso ea Thibelo le Tšoaro ea Kotsi ea Malware bakeng sa Li-Desktop le Lilaptop.
• Sehlopha sa Tšireletso sa Google Chrome Enterprise & Chromium: Lethathamo la Leano la Khoebo la Chrome (ExtensionInstallForcelist), Manifest V3 Extension Security Architecture, le Ho Lokisa Ente e sa lumelloeng ea Leano.
• Setsi sa Karabelo ea Ts'ireletso ea Microsoft (MSRC) & Microsoft Defender Threat Intelligence: * Ho sekaseka le ho lokisa CrypToClipper / Clipboard Hijacker Malware le Rogue Browser Policy Registry Persistence (HKLM\SOFTWARE\Policies\Microsoft\Edge)*.
• Setsi sa Naha sa Ts'ireletso ea Cyber ​​​​(NCSC, United Kingdom): Kaelo ya Tshireletso ya Sesebediswa: Ho Laola Katoloso ya Sebadi, Taolo ya Leano la Kgwebo, le ho Fokotsa Boshodu ba Letshwao.

Litataiso tse amanang¶

• Cryptocurrency wallet drain, polelo ea peo e sekisetse, le ho hlakola tumello
• Ho tlosoa ha malware, ransomware, le ts'oaetso ea spyware
• MFA phishing, adversary-in-the-katikati (AiTM) bypass, le session cookie bosholu
• Karabo ea tlōlo ea molao, li-password tse lutiloeng, le mekitlane e emisoa
• Linomoro tsa maemo a tshohanyetso ho ea ka linaha