Izandiso Zesiphequluli Ezinonya, Izigebengu Ze-Clipboard Clipboard, Nokusetha Kabusha Isiphequluli¶

Ngokubona ukuthi ikheli le-cryptocurrency wallet (BTC, ETH, SOL, USDT) noma i-IBAN yasebhange/inombolo yomzila osanda kukopisha ngayo Ctrl+C (Cmd+C) yashintsha ngomlingo yaba ikheli lomuntu ongamazi ngaso leso sikhathi owucindezelayo Ctrl+V (Cmd+V), ngokuthola ukuthi isandiso se-Chrome, Edge, Brave, noma Firefox owasifaka eminyakeni edlule ("PDF Converter", "Volume Booster", "Video Downloader", noma "AI Assistant") sathengiswa ngokuyimfihlo ku-adware syndicate futhi manje sijova izixhumanisi ezikhohlakele futhi sivuna amakhukhi akho esikhathi, noma ukuthola injini yakho yokusesha ezenzakalelayo ikhiyiwe ekhasini elintshontshiwe lokuqondisa kabusha ngaphansi komlayezo* yinhlangano yakho ephuthumayo ephethwe yisiphequluli sakho* Ngoba iziphequluli zewebhu zesimanje zibamba amakhukhi akho eseshini asebenzayo e-Gmail, i-Microsoft 365, ama-consoles amafu ezinkampani, abaphathi bamagama-mfihlo, kanye nezikhwama ze-Web3, isandiso esisodwa sesiphequluli esinamandla esinikiwe. "Read and change all your data on all websites" (<all_urls> noma *://*/* izimvume zokusingatha) yeqa i-Multi-Factor Authentication (MFA) ngokuphelele ngokufunda okokufaka kwakho kwe-DOM, ukuchofoza izinkinobho, kanye navigator.clipboard buffer ngesikhathi sangempela.

Uma ukufakwa ebucayini kwesiphequluli kuhambisana nokuqola okusebenzayo, izinsongo ezingokwenyama, noma ukuphangwa kwezintambo kwenkampani okuqhubekayo, shayela inombolo yakho yasendaweni yezimo eziphuthumayo (911 e-United States naseCanada, 112 kwi-European Union, 999 e-United Kingdom) noma uthintane nemibhalo yethu yamazwe ngamazwe izinombolo eziphuthumayo ngokushesha. Kuzo zonke izimo zezandiso zesiphequluli ezinonya, uhlelo olungayilungele ikhompuyutha ye-crypto clipboard, noma ukudunwa kwenqubomgomo yesiphequluli, yenza ukususwa kwe-forensic kanye nokuhamba komsebenzi wokuhoxiswa kweseshini ngezansi.

Yenza lokhu manje¶

1. MISA ukunamathisela idatha ebucayi (Ctrl+V / Cmd+V) futhi UNGALINGE ugunyaze okwenziwa yi-cryptocurrency ngaphandle kokuqinisekisa izinhlamvu zokuqala ezingu-6 KANYE nezi-6 zokugcina esikrinini sakho se-wallet yehadiwe: Uhlelo olungayilungele ikhompuyutha lokuduna i-Clipboard ("Clippers" / CrypToClipper) isebenzisa izinkulumo ezivamile (RegEx) ukuqapha isistimu yakho yokusebenza kanye nebhodi lokunamathisela lesiphequluli njalo ngama-millisecond ayi-100. Ngokushesha okopisha a 0x... Ikheli le-Ethereum, bc1... Ikheli le-Bitcoin, noma ikheli lika-Solana, lishintsha okuqukethwe kwebhodi lokunamathisela nekheli elibukeka njengeze elingelolamhlaseli.
2. Nqamula ikhompyutha enegciwane ku-Wi-Fi / Ethernet ngaphambi kokuvula chrome://extensions (edge://extensions / about:addons): Izandiso eziningi ezinonya zibuka umsebenzisi ozulazula kuthebhu yokuphatha izandiso futhi avale ngokuzenzakalelayo ithebhu, azifihle, noma enze ukulahlwa kokugcina kwamakhukhi akho esikhathi esivuliwe ngaphambi kokuthi uchofoze okuthi Susa. Ukuvala i-Wi-Fi kuqala kunciphisa umyalo nokulawula kwabo (C2) isiteshi.
3. Vala "Ukuvumelanisa Izandiso" ku-akhawunti yakho ye-Google, ye-Microsoft, noma ye-Mozilla NGAPHAMBI kokususa isandiso esiyingozi: Uma Ukuvumelanisa kwe-Chrome, Ukuvumelanisa kwe-Edge, noma Ukuvumelanisa kwe-Firefox kunikwe amandla, ukususa isandiso esinonya endaweni kukhompuyutha ephathekayo eyodwa kuvame ukuhluleka ngenxa yokuthi iphrofayela yakho yefu noma enye ideskithophu engene ngemvume iphusha kabusha isandiso sibuyele emshinini wakho emizuzwini kamuva. Iya ku chrome://settings/syncSetup/advanced (edge://settings/profiles/sync) bese uguqula okuthi Izandiso ukuze okuthi VALIWE kuqala.
4. Rekhoda i-ID Yesandiso enezinhlamvu ezingu-32 (Developer Mode -> ID) bese ususa isandiso KANYE nendawo yaso IndexedDB / Local Extension Settings ifolda kudiski: Ngaphambi kokuchofoza Khipha, vula Imodi kanjiniyela ekhoneni eliphezulu kwesokudla se chrome://extensions bese ubhala phansi i-ID enezinhlamvu ezingama-32 (isibonelo, aeblfdkhhhdcdjpifhhbdiojplfjncoa). Ukwazi ukuthi i-ID ngqo ikuvumela ukuthi uqinisekise ukuthi isandiso simakwe njengohlelo olungayilungele ikhompuyutha futhi uhlanze ifolda yayo esele ngaphakathi kwendawo yangakini. AppData / Library umkhombandlela.
5. Sula izinqubomgomo zesiphequluli sebhizinisi mbumbulu (chrome://policy futhi edge://policy) ezithi "Isiphequluli sakho siphethwe inhlangano yakho": Kukhompyutha yomuntu siqu yasekhaya, ukubona "Kuphethwe inhlangano yakho" kusho i-adware noma i-trojan ibhale isigebengu ExtensionInstallForcelist noma SearchProvider key ku-Windows Registry yakho (HKLM\SOFTWARE\Policies\Google\Chrome) noma amaphrofayili wokucushwa kwe-macOS (System Settings -> General -> Device Management) ngakho awukwazi ukuchofoza inkinobho ethi Susa.
6. Yenza angavumelekile wonke amakhukhi esikhathi sesiphequluli esintshontshiwe ngokuchofoza okuthi "Phuma kuzo zonke izikhathi" kudivayisi ehlanzekile: Ngoba isandiso esinonya nge <all_urls> imvume noma chrome.cookies ukufinyelela sekukopishe amathokheni akho okungena bukhoma, ukususa nje isandiso **akukhiphi umhlaseli kuma-akhawunti akho. Sebenzisa i-smartphone ehlanzekile ukuze uphoqelele i-global Phuma Kuwo Wonke Amadivayisi / Uhoxise Izikhathi ku-imeyili yakho, amabhange, amafu, nama-akhawunti omphakathi, futhi uzungezise amaphasiwedi akho ulandela eyethu impendulo yokwephulwa kwedatha kanye nomhlahlandlela wokuvuza kwephasiwedi.

Isihlahla sesinqumo: ukuhlukanisa izinsongo zesandiso sesiphequluli, izigebengu zenqubomgomo, neziqeshana ze-OS¶

Landela leli shati eligelezayo lokuxilonga ukuze ubone ukuthi yisiphi isendlalelo sesiphequluli sakho noma isistimu yokusebenza esengozini futhi uqede indlela yokuphikelela:

flowchart TD
    Start["Kutholwe Okungaziwa Kwesiphequluli: Ikheli Lebhodi Lokunamathisela Lishintshiwe, Usesho Luqondiswe Kabusha, Ama-Rogue Popups, noma Iseshini Ye-akhawunti Intshontshiwe"] --> Test{"1. Vala Isiphequluli Ngokuphelele & Kopisha/Namathisela Ikheli Le-Crypto ku-Notepad / UmbhaloHlela: Ingabe Iyashintsha?"}
    Test -->|"Yebo: Ikheli Lishintsha Isiphequluli Esingaphandle"| OSClip["I-OS-LEVEL CLIPPER MALWARE: Kill Rogue Process ku-Task Manager, Hlanza Imisebenzi Ehleliwe / Qalisa Okhiye & Qalisa Iskena se-AV Ungaxhumekile ku-inthanethi"]
    Test -->|"Cha: Kwenzeka Ngaphakathi Kwesiphequluli Kuphela"| PolicyCheck{"2. Vula i-chrome://inqubomgomo noma i-edge://policy: Ingabe Izinqubomgomo Zisohlwini Lwe-PC Yakho Yasekhaya?"}
    PolicyCheck -->|"Yebo: 'Kuphethwe inhlangano yakho' / ExtensionInstallForcelist"| WipePolicy["Susa okhiye benqubomgomo ye-Rogue Windows Registry (Izinqubomgomo ze-HKLM/HKCU) noma Susa iphrofayela yokucushwa kwe-macOS"]
    PolicyCheck -->|"Azikho Izinqubomgomo Ezitholiwe"| ExtAudit["3. Khubaza Ukuvumelanisa -> Nika amandla Imodi Yonjiniyela ku-chrome://extensions -> Khomba futhi Ususe Izandiso Ezinonya"]
    WipePolicy --> ExtAudit
    OSClip --> ExtAudit
    ExtAudit --> DiskWipe["4. Susa Amafolda Esandiso Esalela, Abasebenzi Besevisi & Inqolobane ye-IndexedDB Kuhla Lwemibhalo Yephrofayela Yomsebenzisi Wasendaweni"]
    DiskWipe --> CookieRevoke["5. Kusuka Kudivayisi Ehlanzekile: Hoxisa Zonke Izikhathi Ezisebenzayo (i-Google, i-Microsoft, i-GitHub, Amabhange) futhi Uhlole Ukuvunyelwa kwe-Crypto"]

Izandiso zesiphequluli ezisemthethweni ziba nonya kanjani ngobusuku obubodwa (kanye nezinhlobo ezi-5 zokuhlasela)¶

Ngaphezulu kwamaphesenti angu-70 ezisulu ezingenwe izandiso zesiphequluli ezinonya azikaze zichofoze isixhumanisi sesofthiwe esonakele: zifake isandiso esivamile, esikalwe kakhulu sisuka ngqo ku-Chrome Web Store*, Microsoft Edge Add-ons Store, noma Izengezo zeFirefox (AMO) izinyanga noma iminyaka ngaphambili. Izigebengu ze-Cybercriminal zibeka engcupheni izandiso ngokusebenzisa izindlela ezimbili ze-supply-chain: 1. Ukuthola Isandiso / Ukuthathwa Kwendlela Yokwenza Imali (lapho umhlaseli enikeza unjiniyela ozimele imali engu-\(5,000 kuya ku-\)50,000 ukuze athenge ubunikazi besandiso esidumile sabasebenzisi abangu-100,000, bese ephusha isibuyekezo esizenzakalelayo esithulile esiqukethe uhlelo olungayilungele ikhompuyutha olufiphele isiphequluli somsebenzisi esikhona esisilanda ngokuzenzakalelayo ngemuva); kanye 2. I-OAuth Phishing kanjiniyela (lapho abahlaseli bekhohlisa i-akhawunti yomdali we-Chrome Web Store yomdali, njengoba kwenzekile ekwephuleni umthetho omkhulu we-supply chain okuthinta inqwaba yebhizinisi nezandiso zokuphepha).

Isigaba 1: Ungahlola kanjani, uhlonze, futhi ukhiphe izandiso ezinonya ku-Chrome, Edge, Brave, Firefox, kanye neSafari¶

Ungamane ubheke izithonjana eduze kwebha yakho yekheli: izandiso ezinonya zifihla ngamabomu isithonjana sazo sebha yamathuluzi (Action inkinobho efihliwe) noma zihlanganise usebenzisa isithonjana kanye negama elithi Google Amadokhumenti Engaxhunyiwe Ku-inthanethi, I-Google Translate, uBlock Origin, noma i-Adobe Acrobat.

Isinyathelo 1: Hlola izandiso zakho ezifakiwe bese uthwebula i-ID enezinhlamvu ezingama-32¶

1. Nqamula ikhompuyutha yakho ku-Wi-Fi / Ethernet ukuze kungabikho isandiso esingadlulisela ukulayishwa kwedatha kokugcina noma ukuzibuyekeza wena ngenkathi usihlola.
2. Vula ikhonsoli yokuphatha isandiso sangaphakathi sesiphequluli sakho ngokuthayipha i-URI eqondile kubha yekheli:
3. I-Google Chrome: chrome://extensions
4. I-Microsoft Edge: edge://extensions
5. Isiphequluli Esinesibindi: brave://extensions
6. I-Mozilla Firefox: about:addons (futhi futhi thayipha about:debugging#/runtime/this-firefox ukubona izengezo zesikhashana/ezifihliwe)
7. I-Apple Safari (macOS): Safari -> Settings (Cmd + ,) -> Extensions
8. VULA "Imodi Yonjiniyela" (guqula iswishi ekhoneni eliphezulu kwesokudla se-Chrome, Edge, kanye ne-Brave).
9. Ukuvula Imodi kanjiniyela kuveza imininingwane ebalulekile yezobunhloli kuwo wonke amakhadi wesandiso:
10. ID: Iyunithi yezinhlamvu ehlukile enezinhlamvu ezingu-32 (njenge cjpalhdlnbpafiamejdnhcphjbkeiagm).
11. Inspect views: service worker / background page: Ibonisa ukuthi ingabe isandiso sisebenzisa iskripthi sangemuva okwamanje.
12. Source: Installed by enterprise policy noma Loaded from: C:\Users\... (Isandiso Esingapakishiwe): Ngaphandle kwalapho ungumthuthukisi wesofthiwe ozibhalele isandiso ngokwakho, asikho isandiso esisemthethweni somthengi okufanele sisho Loaded from: [Folder Path] (Isandiso Esingapakishiwe). Ababhali bohlelo olungayilungele ikhompuyutha balayisha eceleni izandiso ezingapakishwanga ezifihliwe AppData noma ProgramData amafolda ngokuguqulwa kwezinqamuleli (chrome.exe --load-extension="C:\...") ukudlula iskena sokuphepha seSitolo Sewebhu se-Chrome ngokuphelele.
13. Hlola zonke izandiso ngokumelene nalezi Zimo Zokususa:
14. Chofoza Imininingwane -> Izimvume (Site access) kuso sonke isandiso esisodwa. Noma yisiphi isandiso esine-On all sites (Read and change all your data on all websites)* okungelona ithuluzi lokuvikeleka elithembeke ngokujulile, eliqinisekisekayo lomthombo ovulekile (elifana nomphathi wakho wephasiwedi oyinhloko) kufanele lisuswe ngokushesha, noma okungenani libe lokufinyelela Isayithi likhawulelwe On all sites ku On click.
15. Chofoza okuthi Susa kunoma yisiphi isiguquli se-PDF, i-VPN yamahhala, isilandi sevidiyo/MP3, isithuthukisi sevolumu, ikhesa yangokwezifiso, ukuguqula kwemodi emnyama, isitholi sekhuphoni, ibha eseceleni ye-AI, noma isandiso somdlalo ongasidingi ngempela.

Isinyathelo sesi-2: Hlola Isandiso manifest.json kanye Nethrafikhi Yenethiwekhi Ebukhoma Ngaphambi Kokususwa (I-Forensic Triage)¶

Uma udinga ukwazi ukuthi ingabe isandiso esisolisayo sintshontshe amaphasiwedi akho enkampani, amakhukhi eseshini, noma okhiye be-cryptocurrency ngaphambi kokuthi usisuse, thatha imizuzu emibili ukuhlola amafayela omthombo wendawo kudiski ngenkathi i-Wi-Fi yakho isanqanyuliwe: 1. Kopisha izinhlamvu ezingu-32 ID eboniswe ekhadini lesandiso ku chrome://extensions. 2. Zulazulela endaweni yesiphequluli sakho Extensions folda kudiski (esohlwini lwethebula elikuSinyathelo sesi-4 ngezansi) bese uvule ifolda emesha leyo ID enezinhlamvu ezingama-32. 3. Vula i-manifest.json ifayela ngaphakathi kwaleyo folda usebenzisa iWindows Notepad noma i-macOS TextEdit bese uhlola izinkambu ezintathu: - "permissions" futhi "host_permissions": Bheka izimvume ezinobungozi obukhulu kufaka phakathi "cookies", "webRequest", "declarativeNetRequest", "clipboardRead", "clipboardWrite", "scripting", "debugger", "proxy", futhi "<all_urls>". Isandiso esithi "i-Dark Mode Toggle" noma "i-Volume Booster" elula esicelayo. "cookies" futhi "<all_urls>" icishe ivune izikhathi zokungena. - "content_scripts": Ibonisa ukuthi yimaphi amafayela e-JavaScript (content.js, inject.js) afakwa kuwo wonke amakhasi ewebhu owavakashelayo, okuhlanganisa nokubhange kanye nezingosi ze-crypto wallet. - "background" ("service_worker"): Ikhomba umbhalo wangemuva oqhubekayo (background.js noma sw.js). Isesha lelo fayela le-JavaScript ku-Notepad ukuthola amayunithi ezinhlamvu afana nalawa fetch(, XMLHttpRequest, WebSocket, navigator.clipboard, chrome.cookies.getAll, eth_sendTransaction, noma atob( yembula umyalo nokulawula komhlaseli (C2) futhi ikhombisa ngqo ukuthi iyiphi idatha ehlungiwe.

Isinyathelo sesi-3: Hlola Ukudunwa Kwethagethi Yesiphequluli (--load-extension)¶

Ngisho nangemva kokuchofoza okuthi Khipha ngaphakathi chrome://extensions, isu elivamile le-trojan lilungisa isithonjana sesinqamuleli sedeskithophu nebha yomsebenzi osichofozayo ukuze uqalise i-Chrome, i-Edge, noma i-Brave ukuze ilayishe ngokuzenzakalelayo isandiso esingapakishiwe esifihliwe ngaso sonke isikhathi uma uvula isiphequluli. - Ku-Windows: 1. Chofoza kwesokudla isithonjana sakho se- Google Chrome / Microsoft Edge / Brave kudeskithophu yakho (bese uchofoza kwesokudla isithonjana ku-Taskbar yakho -> chofoza kwesokudla igama lesiphequluli futhi -> chofoza Properties). 2. Bheka ibhokisi elithi Impokophelo: ngaphansi kwethebhu ethi Isinqamuleli. 3. Ibhokisi Elihlosiwe elihlanzekile liphetha ngokuthi "chrome.exe" noma "msedge.exe": - HLANZA: "C:\Program Files\Google\Chrome\Application\chrome.exe" - ISHONWE: "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\Public\Documents\ExtUpdater" https://search-hijack.com 4. Susa yonke into ngemva chrome.exe" (noma susa isinqamuleli ngokuphelele bese uphina isinqamuleli esisha ngokuqondile C:\Program Files\Google\Chrome\Application\chrome.exe).

Isinyathelo sesi-4: Susa Amafayela Esandiso Asele Nezisebenzi Zesevisi kuDisk¶

Thola uhla lwemibhalo lwephrofayela yesiphequluli sakho bese ususa ifolda engaphansi efana ne-ID enezinhlamvu ezingu-32 yesandiso esikhohlakele, kanye nokuhlanza abasebenzi besevisi ababhalisiwe:

Ngemva kokususa ifolda yokunweba, vula chrome://serviceworker-internals (noma edge://serviceworker-internals) esipheqululini sakho bese uchofoza okuthi Susa ukubhalisa kunoma yisiphi isisebenzi sesevisi esihlotshaniswa nesandiso esisusiwe noma izizinda ezingajwayelekile zesaziso sohlelo lokusebenza.

Isinyathelo sesi-5: Hlanza Izimvume Zezaziso Zokusunduza, Izinjini Zokusesha Eziduniwe, kanye Nezilungiselelo Zommeleli Ononya / DNS¶

Izandiso eziningi ze-adware nezigebengu zesiphequluli zishiya ngemuva izicupho ezintathu zesibili ngisho nangemva kokuba isandiso se-binary sisusiwe: 1. Hoxisa Okubhaliselwe Kwezaziso Zokusunduza Kwewebhu Okunonya (Izigelekeqe Zokulwa Namagciwane Ezingelona iqiniso): - Uma izexwayiso zamanga ze-McAfee, i-Norton, noma i-Windows Defender ngegciwane zilokhu zivela ekhoneni elingezansi kwesokudla kwesikrini sakho noma nini lapho isiphequluli sakho sivuliwe, lezo ziyi-HTML5 Web Push Notifications eziphuma kusayithi elikhohlakele onikeze imvume yesaziso kuyo ngephutha. - Vula chrome://settings/content/notifications (noma edge://settings/content/notifications / about:preferences#privacy -> Izimvume -> Izaziso kuFirefox). - Skrolela phansi ohlwini "Ivunyelwe ukuthumela izaziso", chofoza amachashazi amathathu eduze kwaso sonke isizinda esingajwayelekile noma esisolisayo, bese uchofoza okuthi Khipha noma Vimba. 2. Setha kabusha Injini Yokusesha Ezenzakalelayo Eduniwe Namakhasi Okuqalisa: - Vula chrome://settings/searchEngines (edge://settings/search) futhi uqinisekise ukuthi injini yakho yokusesha ezenzakalelayo ikhomba ku-Google yangempela (google.com), i-DuckDuckGo, noma i-Bing kune-URL yokuqondisa kabusha ecishe ifane (search.yahoo.com/yhs/... noma find-results.net). Susa zonke izinjini zokusesha ezingaziwa ohlwini. - Vula chrome://settings/onStartup (edge://settings/onStartup) bese uhlola "Vula ikhasi elithile noma isethi yamakhasi": susa noma imaphi ama-URL okuqalisa angawajwayele afakwe i-adware. 3. Hlola ummeleli wesistimu ontshontshiwe noma i-DNS evikelekile (DoH) Izilungiselelo: - Ezinye izandiso ezinonya nezifaki ze-adware zimisa umbhalo wendawo PAC (Proxy Auto-Config) noma i-DNS-over-HTTPS (DoH)* iseva ukuze ikwazi ukuqhubeka nokunqanda ithrafikhi yakho yewebhu ngemuva kokuthi isandiso sihambile. - Ku-Chrome/Edge, hamba ku-chrome://settings/security -> skrolela kokuthi Sebenzisa i-DNS evikelekile bese uqinisekisa ukuthi isethwe kumhlinzeki wakho wesevisi wamanje noma isixazululi esisethenjwayo somphakathi (Cloudflare 1.1.1.1, Quad9 9.9.9.9, noma Google Public DNS), hhayi i-URL yangokwezifiso engajwayelekile. - Bese uvula chrome://settings/system -> chofoza Vula izilungiselelo zommeleli wekhompyutha yakho, futhi uqinisekise ukuthi "Sebenzisa iskripthi sokusetha" kanye nokuthi "Sebenzisa iseva elibamba" zombili zivaliwe ** IVALIWE** (ngaphandle kwalapho kudingwa umqashi wakho).

Isigaba sesi-2: Ukususa izinqubomgomo zebhizinisi mbumbulu "Eziphethwe inhlangano yakho" (ExtensionInstallForcelist)¶

Uma uku ikhompuyutha yasekhaya yomuntu siqu (hhayi ikhompuyutha ephathekayo ekhishwe umqashi wakho noma isikole) futhi awukwazi ukuchofoza inkinobho ethi Khipha esandisweni esisolisayo ngenxa yokuthi inomfanekiso omncane wokwakha ihhovisi eduze kwayo kanye nezibonisi ze-Chrome/Edge "Isiphequluli sakho siphethwe inhlangano yakho", i-adware ifake imithetho mbumbulu Yenqubomgomo Yeqembu Yebhizinisi ohlelweni lwakho lokusebenza.

Isinyathelo 1: Hlola chrome://policy noma edge://policy¶

Thayipha chrome://policy (noma edge://policy / about:policies kuFirefox) kubha yakho yekheli. - Bheka amagama enqubomgomo njengokuthi ExtensionInstallForcelist, ExtensionInstallAllowlist, ExtensionSettings, HomepageLocation, RestoreOnStartupURLs, noma DefaultSearchProviderSearchURL. - Ikholomu ethi Inani eduze kwe ExtensionInstallForcelist izobonisa i-ID Yesandiso enezinhlamvu ezingu-32 yesandiso sohlelo olungayilungele ikhompuyutha kanye ne-URL yesibuyekezo ekhipha kuyo.

Isinyathelo sesi-2: Hlanza Izinqubomgomo Zesiphequluli Se-Rogue ku-Windows (I-Elevated Command Prompt)¶

Ekhaya lomuntu siqu Windows 10 noma i-Windows 11 PC okungafanele okungafanele ibe nanoma yiziphi izinqubomgomo zesiphequluli senkampani ezisetshenzisiwe, chofoza i-Start Menu, thayipha cmd, chofoza kwesokudla ** I-Command Prompt**, khetha Sebenzisa njengomlawuli, futhi wenze le miyalo ukuze usule i-Chrome, i-Edge, ne-Brave yokubhalisa inqubomgomo yokubhalisa izidleke futhi uvuselele Inqubomgomo Yeqembu:

reg delete "HKLM\SOFTWARE\Policies\Google\Chrome" /f
reg delete "HKCU\SOFTWARE\Policies\Google\Chrome" /f
reg delete "HKLM\SOFTWARE\Policies\Google\Update" /f
reg delete "HKCU\SOFTWARE\Policies\Google\Update" /f
reg delete "HKLM\SOFTWARE\WOW6432Node\Google\Enrollment" /f
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Edge" /f
reg delete "HKCU\SOFTWARE\Policies\Microsoft\Edge" /f
reg delete "HKLM\SOFTWARE\Policies\BraveSoftware\Brave" /f
reg delete "HKCU\SOFTWARE\Policies\BraveSoftware\Brave" /f
rmdir /s /q "%WinDir%\System32\GroupPolicy"
rmdir /s /q "%WinDir%\System32\GroupPolicyUsers"
gpupdate /force

Ngemva kokusebenzisa leyo miyalo, buyela kokuthi chrome://policy (noma edge://policy) bese uchofoza inkinobho ethi Layisha kabusha izinqubomgomo ekhoneni eliphezulu kwesokunxele. Zonke izinqubomgomo zebhizinisi eziphoqelelwe zizoshabalala ngokushesha, futhi inkinobho ethi Susa ingene chrome://extensions izovula.

Isinyathelo sesi-3: Hlanza Izinqubomgomo Zesiphequluli Se-Rogue namaphrofayili Wokucushwa ku-macOS¶

KumacOS, izigebengu zesiphequluli zisebenzisa izinqubomgomo zamabhizinisi mbumbulu zisebenzisa izindlela ezimbili: 1. Amaphrofayili wokucushwa kwe-macOS (MDM amaphrofayili) umsebenzisi akhohliswe ukuthi akufake ngesifaki esiyimbumbulu seFlash/video player, kanye 2. Iphethwe plist amafayela athandwayo.

1. Hlola futhi Ususe Amaphrofayili Okulungisa Ama-macOS:
2. Vula Imenyu ye-Apple -> Izilungiselelo Zesistimu -> Okuvamile -> Ukuphathwa Kwedivayisi (ku-macOS Monterey/Big Sur endala, vula Izintandokazi Zesistimu -> Amaphrofayili).
3. Uma uku-Mac yomuntu siqu futhi ubona noma iyiphi iphrofayela esohlwini ngaphansi Kokuphathwa Kwedivayisi/Amaphrofayela (imvamisa ebizwa ngokuthi "Izilungiselelo ze-Chrome", "SearchConfig", "AdminPrefs", noma "WeKnow"), ikhethe bese uchofoza - (Susa) inkinobho ezansi, bese ufaka iphasiwedi yakho ye-Mac ukuze uyisuse.
4. Susa Isiphequluli Esiphethwe plist Amafayela nge-macOS Terminal:
5. Vula Itheminali (Cmd + Space, uhlobo Terminal) bese usebenzisa le miyalo ukuze ususe ukuphoqelelwa plist amafayela enqubomgomo bese usula ifayela le cfprefsd inqolobane:

sudo rm -f /Library/Managed\ Preferences/com.google.Chrome.plist
sudo rm -f /Library/Managed\ Preferences/*/com.google.Chrome.plist
sudo rm -f /Library/Preferences/com.google.Chrome.plist
rm -f ~/Library/Preferences/com.google.Chrome.plist
sudo rm -f /Library/Managed\ Preferences/com.microsoft.Edge.plist
sudo rm -f /Library/Preferences/com.microsoft.Edge.plist
defaults delete com.google.Chrome ExtensionInstallForcelist 2>/dev/null
defaults delete com.google.Chrome HomepageLocation 2>/dev/null
sudo killall cfprefsd

Qala kabusha i-Chrome/Edge futhi uqinisekise kokuthi chrome://policy ukuthi izinqubomgomo zero zihlala zisebenza.

Isigaba sesi-3: Ukuthola futhi kuqedwe Izigebengu Ze-Crypto Clipboard zezinga le-OS ("Ama-Clippers")¶

Kuthiwani uma ususa zonke isandiso sesiphequluli, uvale isiphequluli sakho ngokuphelele, futhi uhlole ukukopisha ikheli le-crypto wallet (0x... noma bc1...) ngaphakathi kwe-Windows Notepad noma i-macOS TextEdit, futhi ikheli elinamathiselwe lisashintsha libe yikheli lesikhwama somhlaseli?

Lokho kusho ukuthi Isistimu Esebenzayo yezinga le-Clipper Malware kanambambili (Laplas Clipper, ClipBanker, phemedrone, RedLine, noma i-Python/Node/AutoIt script) isebenza ngemuva kohlelo lwakho lokusebenza futhi ibiza iWindows. AddClipboardFormatListener / SetClipboardData I-API (noma i-macOS NSPasteboard i-polling loop).

Isinyathelo 1: Thola ukuthi Iyiphi Inqubo Okwamanje Ephethe noma Evotela Ibhodi lakho lokunamathisela¶

• Ku-Windows (Inqubo ye-PowerShell Live & Startup Audit): Vula i-PowerShell njengoMlawuli bese uqalisa lo myalo wokuxilonga ukuze ufake kuhlu zonke izinqubo zasemuva okungezona eze-Microsoft eziphelelwa yimibhalo ebhalwa umsebenzisi (AppData, Temp, ProgramData, Users\Public) lapho amaphesenti angama-99 eClipper Trojans ehlala khona:

Get-CimInstance Win32_Process | Where-Object {
    $_.ExecutablePath -match "AppData|Temp|ProgramData|Users\\Public"
} | Select-Object ProcessId, Name, ExecutablePath, CommandLine | Format-List

Hlola okukhiphayo ukuthi kuyasolisa .exe, pythonw.exe, wscript.exe, cscript.exe, powershell.exe, mshta.exe, noma AutoIt3.exe izinqubo eziphelayo %AppData%\Roaming, %LocalAppData%\Temp, noma C:\ProgramData. Qaphela i ProcessId (PID) kanye ExecutablePath, qeda inqubo nge Stop-Process -Id <PID> -Force, bese ususa kanambambili kudiski.

• Hlola izindawo ze-Windows Persistence (Run Okhiye & Scheduled Tasks): Ama-Clippers asinda ekuqaliseni kabusha ngokungeza i-Registry Run ukhiye, isiqalo .lnk ifayela ku shell:startup, noma Umsebenzi Ohleliwe. Qalisa lokhu kuhlola okubili kwe-PowerShell ukuze uwaveze:

Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run", "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
Get-ScheduledTask | Where-Object {$_.State -ne "Disabled" -and $_.Author -notmatch "Microsoft"} | Select-Object TaskName, TaskPath, State

Landa I-Microsoft Sysinternals Autoruns (Autoruns64.exe) kusuka learn.microsoft.com/en-us/sysinternals/downloads/autoruns, isebenzise Njengomlawuli, yenza ukuthi Izinketho -> Izinketho zokuskena -> Qinisekisa amasiginesha ekhodi + Hlola i-VirusTotal.com, bese ususa noma yikuphi okufakiwe okubomvu/ okungabhalisiwe kumathebhu ethi Logon, Imisebenzi Ehleliwe, noma ethi WMI.

• KumacOS (LaunchAgents & Background Process Audit): Vula Itheminali bese uhlola wonke umsebenzisi nohlelo LaunchAgents futhi LaunchDaemons (lapho iziqeshana ze-macOS kanye Atomic Stealer / Poseidon persistence scripts hide):

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons
ps aux | grep -E "osascript|python|node|curl|base64|NSPasteboard"

Hlola noma yikuphi okungajwayelekile .plist ifayela ku -/Library/LaunchAgents usebenzisa cat -/Library/LaunchAgents/<filename>.plist, yehlise nge launchctl unload -/Library/LaunchAgents/<filename>.plist, bese ususa kokubili i- .plist kanye kanambambili ekhomba kuyo.

Isigaba sesi-4: Ukuthola kabusha ngemva kokutheleleka (uhoxisa amakhukhi esikhathi ebiwe, amathokheni e-OAuth, nezimvume ze-Web3)¶

Ukususa isandiso sesiphequluli esinonya kumisa ukuhlola okuzayo, kodwa akuwenzi amakhukhi esikhathi, amaphasiwedi alondoloziwe, noma imishwana yembewu yesikhwama semali isandiso sesivele silayishwe kuseva yomhlaseli ngenkathi sifakiwe. Cabanga ukuthi wonke amathebhu abevuliwe nawo wonke amaphasiwedi agcinwe ngaphakathi kwesiphathi sephasiwedi esakhelwe ngaphakathi sesiphequluli sisengozini:

1. Phoqa I-Global "Phuma Kuzo Zonke Izikhathi" Kuma-akhawunti Akho Abalulekile:
2. Ukushintsha igama-mfihlo ngezinye izikhathi kushiya amathokheni akhona e-OAuth noma izikhathi zeselula/zewebhu zivumeleke kuze kube ihora. Ngena ngemvume kusukela kudivayisi ehlanzekile bese uchofoza ngokucacile Phuma Kuwo Wonke Amaseshini / Hoxisa Wonke Amadivayisi:
   • I-Google / Gmail: myaccount.google.com/device-activity -> khetha zonke izikhathi ezingajwayelekile noma zedeskithophu -> Phuma. Futhi hlola myaccount.google.com/permissions ukuhoxisa izinhlelo zokusebenza ze-OAuth zezinkampani zangaphandle.
   • I-Microsoft / Outlook / 365: account.live.com/proofs/manage/additional -> chofoza okuthi Ngikhiphe (kuphoqa ukuthi uphume emhlabeni wonke kuzo zonke iziphequluli phakathi kwamahora angu-24).
   • GitHub / GitLab / AWS / Cloud Consoles: Iya ku github.com/settings/sessions -> **Hoxisa zonke izikhathi **, bese uzungezisa noma yimaphi amathokheni okufinyelela komuntu siqu (PATs) noma okhiye be-SSH.
   • I-Discord / Slack / Social Media: Qaphela ukuthi izandiso ezinonya ziqondise ngqo i-Discord's Local Storage ithokheni yokuqinisekisa kanye namakhukhi we-Facebook Business Manager; shintsha iphasiwedi yakho ye-Discord (ekhiqiza kabusha ngokuzenzakalelayo ithokheni yakho yomsebenzisi we-Discord) futhi unqamule zonke izikhathi ezisebenzayo ku-Facebook/Instagram Security Settings.
3. Thutha Noma iyiphi I-Crypto Wallet Yesoftware (MetaMask, Phantom, Rabby, Keplr) Okufakwe Esipheqululini Esifanayo:
4. Uma kunesandiso esinonya <all_urls> noma scripting ukufinyelela, noma uma i-infostealer yezinga le-OS isebenza ku-PC yakho, kungenzeka ifunde ifayela lakho elibethelwe le-vault (ldb amafayela ku Local Extension Settings) futhi yathatha iphasiwedi yakho yokuvula isikhwama sakho semali njengoba uyibhala.
5. Ungagcini** izimali kulowo mushwana wembewu wesikhwama semali esishisayo. Khiqiza ibinzana lembewu ye-wallet entsha sha kudivayisi* ehlanzekile noma i-Hardware Wallet (Ledger, Trezor, Keystone)**, dlulisela izimpahla zakho ezisele esikhwameni esisha, futhi uhoxise ukugunyazwa kwamathokheni alengayo ku- revoke.cash kulandela okwethu i-cryptocurrency wallet drain kanye neseed phrase compromise guide.
6. Yenza Ukusetha Kabusha Isiphequluli Okugcwele:
7. Iya ku chrome://settings/reset (edge://settings/reset / about:support -> Vuselela iFirefox) bese uchofoza okuthi Buyisela izilungiselelo kokumisiwe kwazo kwasekuqaleni. Lokhu kusetha kabusha ikhasi lakho lokuqala, ikhasi lethebhu elisha, injini yokusesha, namathebhu aphiniwe, kusula amakhukhi wesikhashana, futhi kukhubaze noma yiziphi izandiso ezisele.

Imibuzo ejwayelekile ukubuzwa¶

Kungani isandiso engangisisebenzise ngokuphepha iminyaka engu-2 ngokuzumayo saphenduka uhlelo olungayilungele ikhompuyutha noma i-adware?¶

Izandiso zesiphequluli zibuyekeza ngokuzenzakalelayo futhi buthule ngemuva ngaphandle kokucela imvume yakho ngaphandle uma inguqulo entsha icela isigaba semvume esisha sha. Amaqembu ezigebengu ze-Cyber ​​​​namaqembu okukhwabanisa kwezikhangiso ahlala axhumana nonjiniyela ababodwa bezandiso ezidumile, ezisemthethweni (njengamathuluzi e-PDF, izithuthukisi zevolumu, izirekhodi zesikrini, noma izivimbeli zesikhangiso) futhi zibanikeze izinkulungwane zamadola ukuze bathengise i-akhawunti yabo yonjiniyela weSitolo Sewebhu se-Chrome noma ukudlulisa ubunikazi besandiso. Uma umthengi elawula ukufakwa kuhlu, bacindezela isibuyekezo senguqulo ethule equkethe ukweba amakhukhi noma ikhodi yokugetshengwa kwenkampani ephethwe ethelela wonke umsebenzisi okhona ngobusuku obubodwa.

Ingabe isibuyekezo se-Google Manifest V3 senza izandiso ze-Chrome ne-Edge ziphephe ngokuphelele kuhlelo olungayilungele ikhompuyutha?¶

Cha. Nakuba i-Manifest V3 ithuthukisa kakhulu ukuphepha ngokuvimbela izandiso ekulayisheni ikhodi ye-JavaScript esingathwa ukude ebanjwe ukude evela eziphakelini zangaphandle (okuphoqa ukuthi yonke ikhodi ihlanganiswe ngaphakathi kwephakheji yesandiso ethunyelwe esitolo), izandiso ezinonya ezihlanganiswe ngaphansi kwe-Manifest V3 zisengasebenzisa kabi izimvume zomsingathi ezibanzi (Kuwo wonke amasayithi), funda okokufaka kwefomu le-DOM nokuchofoza izinkinobho, ukuntshontsha amakhukhi okuqukethwe, ukugebenga umbhalo, i-mainboard kanye ne-mainboard. DeclarativeNetRequest imithetho. Ukukhawulela izandiso kulabo obathemba ngokuqinile kuphela nokusetha imvume yabo Yokufinyelela Isayithi ukuthi "Ngokuchofoza" kunokuthi "Kuwo wonke amasayithi" kusabalulekile.

Ngingakuvikela kanjani ukudluliswa kwami ​​kwe-cryptocurrency kusukela kuhlelo olungayilungele ikhompuyutha labaduni ebhodini ngokuzayo?¶

Okokuqala, ungalokothi uqinisekise kuphela izinhlamvu zokuqala ezi-4 nezi-4 zokugcina zekheli le-wallet elinamathiselwe, ngoba uhlelo olungayilungele ikhompuyutha yesimanjemanje lusebenzisa amachibi amakheli enziwe ngekhompuyutha enziwe ngaphambili ukuze akhethe ikheli lomhlaseli elabelana ngezinhlamvu ezifanayo zokuqala neziphetha njengomamukeli ohlosiwe; hlola njalo okungenani izinhlamvu zokuqala eziyisi-6, ezimaphakathi nezi-6, nezokugcina eziyi-6. Okwesibili, sebenzisa i-Hardware Wallet engaxhunyiwe ku-inthanethi enesikrini esibonakalayo (njenge-Ledger, Trezor, noma i-GridPlus) futhi uqinisekise ikheli eligcwele lomamukeli esikrinini sangempela sedivayisi yezingxenyekazi zekhompuyutha ngaphambi kokucindezela inkinobho yokuqinisekisa engokoqobo, futhi ulondoloze amakheli omamukeli asetshenziswa njalo ngaphakathi kweBhuku Lekheli eligunyaziwe lesikhwama sakho esikhundleni sokuwakopisha nokuwanamathisela ebhodini lakho lokunamathisela.

Imithombo ihloliwe¶

• I-Cybersecurity and Infrastructure Security Agency (CISA, United States) kanye ne-Federal Bureau of Investigation (FBI): Izeluleko Ezihlanganisiwe Ze-Cybersecurity ku-Infostealer Malware, Ukudunwa Kwekhukhi Lesikhathi, Nezandiso Zesiphequluli Esinonya.
• Isikhungo Sikazwelonke Samazinga Nobuchwepheshe (NIST, United States): SP 800-83 Rev. 1, Umhlahlandlela Wokuvinjelwa Nokuphathwa Kwesigameko Sohlelo Olungayilungele ikhompuyutha Yamakhompuyutha Aphathekayo namalaptop.
• Ithimba le-Google Chrome Enterprise ne-Chromium: Uhlu Lwenqubomgomo Yebhizinisi le-Chrome (ExtensionInstallForcelist), I-Manifest V3 Extension Security Architecture, kanye Nokulungisa Umjovo Wenqubomgomo Ongagunyaziwe.
• I-Microsoft Security Response Center (MSRC) Nobuhlakani be-Microsoft Defender Threat Intelligence: Ukuhlaziya nokulungisa CrypToClipper / I-Clipboard Hijacker Malware kanye ne-Rogue Browser Policy Registry Persistence (HKLM\SOFTWARE\Policies\Microsoft\Edge).
• I-National Cyber ​​Security Centre (NCSC, United Kingdom): Isiqondiso Sokuvikeleka Kwedivayisi: Ukuphatha Izandiso Zesiphequluli, Izilawuli Zenqubomgomo Yebhizinisi, Nokwebiwa Kwethokheni Enciphisa.

Iziqondiso ezihlobene¶

• I-Cryptocurrency wallet drain, ibinzana lembewu lisengozini, kanye nokuhoxisa ukugunyazwa
• Ukususwa kwe-Malware, i-ransomware, kanye ne-spyware infection
• Ubugebengu bokweba imininingwane ebucayi be-MFA, isitha esiphakathi nendawo (AiTM) sidlula, kanye nokwebiwa kwekhukhi leseshini
• Impendulo yokwephulwa kwedatha, amaphasiwedi aputshuziwe, nokumiswa kwekhredithi
• Izinombolo zesimo esiphuthumayo ngezwe