{
  "Event": {
    "analysis": "1",
    "date": "2026-06-29",
    "extends_uuid": "",
    "info": "[Threat Intel] Chrome and Firefox Extensions Posing as Free VPNs Add Clipboard Stealers via Malicious Updates",
    "protected": false,
    "publish_timestamp": "1783099615",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1783099615",
    "uuid": "edebb4ea-e10a-4e1f-bd4d-ab65a665e1ae",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#d3f567",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#9dc839",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Clipboard Data - T1115\"",
        "relationship_type": ""
      },
      {
        "colour": "#75ec20",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "relationship_type": ""
      },
      {
        "colour": "#3780c6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#d596aa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"37ebf9d7-5e9a-466f-a42c-6e60313db868\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005e",
        "local": false,
        "name": "rectifyq:topic=\"supply-chain\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Browser Extensions - T1176.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"github\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"google\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"mozilla\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782874822",
        "to_ids": false,
        "type": "link",
        "uuid": "88913f37-fb15-483e-896e-b81c1dda9abe",
        "value": "https://socket.dev/blog/chrome-and-firefox-extensions-free-vpns-add-clipboard-stealers"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782874822",
        "to_ids": false,
        "type": "text",
        "uuid": "ae7219df-282a-4f0a-8a05-4258f75950f1",
        "value": "Malicious browser extensions distributed through Chrome Web Store and Firefox Add-ons marketplaces posed as free VPN services while secretly stealing clipboard data. The Chrome extension, with 146 users, and Firefox extension, with 3,499 users, initially functioned as proxy tools but later incorporated clipboard theft through staged updates. Chrome versions 1.1 onwards and Firefox version 1.3.3 onwards continuously monitored clipboard contents every 500-1500 milliseconds, capturing passwords, API keys, cryptocurrency addresses, and authentication tokens. Stolen data was chunked, tagged with session identifiers, and exfiltrated via HTTP to attacker-controlled infrastructure at multiple IP addresses. Both extensions shared code patterns, infrastructure, and exfiltration endpoints despite appearing as separate products, indicating coordinated malicious operations behind legitimate-appearing privacy tools."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782874822",
        "to_ids": false,
        "type": "text",
        "uuid": "6d223b89-b367-4c55-a71b-6bc1e6f99796",
        "value": "Name: Chrome and Firefox Extensions Posing as Free VPNs Add Clipboard Stealers via Malicious Updates\nAuthor: AlienVault\nAdversary: \nTags: [\"vpn impersonation\", \"firefox add-ons\", \"free vpn by vpn go\", \"staged updates\", \"supply chain\", \"credential theft\", \"chrome web store\", \"clipboard stealer\", \"vpn go: free vpn\", \"browser extension\"]\nTgtd countries: []\nMlwr families: [\"VPN Go: Free VPN\", \"Free VPN by VPN GO\"]\nAttack_ids: [\"T1059.007\", \"T1115\", \"T1036\", \"T1204\", \"T1041\", \"T1027\", \"T1195.002\", \"T1071.001\"]\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783099362",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c7c8036b-346c-42e3-9406-28e6c1251756",
        "value": "77.91.123.187",
        "Tag": [
          {
            "colour": "#9fc6d7",
            "local": false,
            "name": "asn:asn=\"209847\"",
            "relationship_type": ""
          },
          {
            "colour": "#5b76e7",
            "local": false,
            "name": "asn:as-owner=\"THE\"",
            "relationship_type": ""
          },
          {
            "colour": "#3ae32e",
            "local": false,
            "name": "asn:as-country=\"NL\"",
            "relationship_type": ""
          },
          {
            "colour": "#768323",
            "local": false,
            "name": "misp-galaxy:country=\"netherlands\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783099383",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "bccdbfd2-5f65-4282-b15d-90987b316296",
        "value": "178.236.252.133",
        "Tag": [
          {
            "colour": "#1e9433",
            "local": false,
            "name": "asn:asn=\"215826\"",
            "relationship_type": ""
          },
          {
            "colour": "#04c4b8",
            "local": false,
            "name": "asn:as-owner=\"PARTNER-HOSTING-LTD\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783099404",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "571a5855-5071-4277-94bf-4a9700c5b62a",
        "value": "178.236.252.161",
        "Tag": [
          {
            "colour": "#1e9433",
            "local": false,
            "name": "asn:asn=\"215826\"",
            "relationship_type": ""
          },
          {
            "colour": "#04c4b8",
            "local": false,
            "name": "asn:as-owner=\"PARTNER-HOSTING-LTD\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783099425",
        "to_ids": true,
        "type": "url",
        "uuid": "7c26b1f5-210c-4ef8-87ee-6c4db1372571",
        "value": "http://178.236.252.133/html/continue.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783099446",
        "to_ids": true,
        "type": "url",
        "uuid": "d22ce90e-db28-4858-8995-866f3a5f2c54",
        "value": "http://77.91.123.187/html/continue.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783099467",
        "to_ids": true,
        "type": "url",
        "uuid": "a5765f14-2f4c-4ba4-aa28-f1642b0ef552",
        "value": "http://178.236.252.161/html/continue.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 04/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783097014",
        "to_ids": true,
        "type": "sha256",
        "uuid": "4382ab83-49f8-44ee-8376-55871e25c776",
        "value": "72fc06a8b03720f4a64744eecd5b3f658ad880bdb327c0c465c7bdc66b14a8d2",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 04/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783097016",
        "to_ids": true,
        "type": "sha256",
        "uuid": "bd6d0fd0-c4bd-4466-b205-7891015bf958",
        "value": "fbbdf4bc490ad7b28953630c1707aa68b89d319b9b735f3d8563320b81b21a97",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 04/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783097016",
        "to_ids": true,
        "type": "sha256",
        "uuid": "e0ac6a41-77fa-439a-9596-1047b93bb6ea",
        "value": "2fe9c41901045013ba28ccb9af5870f9aef4f1ffd1e717cd5e0189ffdbe7fca2",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 04/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783097017",
        "to_ids": true,
        "type": "sha256",
        "uuid": "712c8b6c-5e93-4269-8406-36023b3b99a1",
        "value": "11f01e8296a074e6e3b23e9413c51f205d4b6a14146fb4d95bec291d768a9071",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 04/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783097018",
        "to_ids": true,
        "type": "sha256",
        "uuid": "b726e446-8c51-47fa-b2f2-cff30b5d6916",
        "value": "638636692e3eef6c83dbca784a40fb7b6ac95b76d6551a2fbdfebc11588ad8ff",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 04/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783097019",
        "to_ids": true,
        "type": "sha256",
        "uuid": "ba130b4e-7021-4569-98dd-b259a3b48b77",
        "value": "7386252b9a86e5357e6aa884326720abf015465a2567e75717830b6688ef05cc",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 04/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783097020",
        "to_ids": true,
        "type": "sha256",
        "uuid": "11281f43-b5a0-467e-93da-86f65c59084e",
        "value": "d7d43e8e8f03afdcaaba85622daf24ced944e7ca4d03ac124fc325d0bb6e3d66",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783099488",
        "to_ids": true,
        "type": "url",
        "uuid": "772dcb72-8d9b-4a5c-ad30-5eabfb194598",
        "value": "http://77.91.123.187/html/continue.php.",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783099509",
        "to_ids": true,
        "type": "domain",
        "uuid": "472c5a8e-4985-4a0c-871b-e787febd1485",
        "value": "gecko.id",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783099531",
        "to_ids": true,
        "type": "domain",
        "uuid": "eef8559a-2d0b-4656-bdfd-ff4ba0c78fc1",
        "value": "vpngogmail.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783099552",
        "to_ids": true,
        "type": "domain",
        "uuid": "1f7cdde3-7374-4319-9fd2-a2673373c660",
        "value": "vpngo.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-06-01T02:36:28+00:00",
        "last_seen": "2026-06-01T02:36:28+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1783099573",
        "uuid": "815dacf8-36a4-47cc-9b68-499c638a67d5",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-01T02:36:28+00:00",
            "last_seen": "2026-06-01T02:36:28+00:00",
            "object_relation": "md5",
            "timestamp": "1783099573",
            "to_ids": true,
            "type": "md5",
            "uuid": "a85f4e32-8f42-4729-a712-e60691e4555a",
            "value": "73e5df48557102621c0756646bc72fef",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-01T02:36:28+00:00",
            "last_seen": "2026-06-01T02:36:28+00:00",
            "object_relation": "sha1",
            "timestamp": "1783097012",
            "to_ids": true,
            "type": "sha1",
            "uuid": "20d6b501-0c47-4567-97fb-98d8b9359172",
            "value": "7b73a3518d5e47023c61cdcfd3a2b368b611b431",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-01T02:36:28+00:00",
            "last_seen": "2026-06-01T02:36:28+00:00",
            "object_relation": "sha256",
            "timestamp": "1783097012",
            "to_ids": true,
            "type": "sha256",
            "uuid": "4a538288-2dc2-4e6a-a971-fc7f723f68db",
            "value": "43dc5b1d4c73d5ed9f4f7f561830079896eeb533a7c21bc577e4e267d5a3aa56",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 04/07/2026\nLast-scan: 03/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-01T02:36:28+00:00",
            "last_seen": "2026-06-01T02:36:28+00:00",
            "object_relation": "text",
            "timestamp": "1783096111",
            "to_ids": false,
            "type": "text",
            "uuid": "01c89c5e-6c1a-4e66-b93d-2a24b651cb9b",
            "value": "Type Description: Google Chrome Extension\nMicrosoft: None\nClamAV: None\nVT Total Detection: 5/74\nFirst Submission: 2026-06-01T02:36:28+00:00\nLast Submission: 2026-06-01T02:36:28+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-01T02:36:28+00:00",
            "last_seen": "2026-06-01T02:36:28+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1783096111",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "3ba7f3e7-067d-4a46-9f07-4780582b9e6d",
            "value": "98304:kkaZ7YjWc1LCG0WI60c1Pa8oyG2Jlt+jsqB4QBWxr5/CRv0pgHFD7zrJ57:5aBKLJpbd0SEIl+Wxr5KZKgHFvzrP"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-01T02:36:28+00:00",
            "last_seen": "2026-06-01T02:36:28+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1783096111",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "58f81d12-b617-4b4b-a2bf-31aef5b37766",
            "value": "5870670"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-01T02:36:28+00:00",
            "last_seen": "2026-06-01T02:36:28+00:00",
            "object_relation": "filename",
            "timestamp": "1783096111",
            "to_ids": true,
            "type": "filename",
            "uuid": "6eb00293-6505-4a37-a06a-f5a3012ad822",
            "value": "jgpfgonjjolillilkjfkiddakagkkpoj.1.1.crx"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-06-03T12:50:20+00:00",
        "last_seen": "2026-06-03T12:50:20+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1783099594",
        "uuid": "2d95037c-0cef-4ef3-a315-9a8649b47e91",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-03T12:50:20+00:00",
            "last_seen": "2026-06-03T12:50:20+00:00",
            "object_relation": "md5",
            "timestamp": "1783099594",
            "to_ids": true,
            "type": "md5",
            "uuid": "cf1c5c25-b8b8-4af4-860d-eb1e7bc8eee3",
            "value": "d568c7fe2d4c4de8b4d7fa5a30a0c251",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-03T12:50:20+00:00",
            "last_seen": "2026-06-03T12:50:20+00:00",
            "object_relation": "sha1",
            "timestamp": "1783097013",
            "to_ids": true,
            "type": "sha1",
            "uuid": "7dab7f2c-0fef-4c37-8263-556864e1eba6",
            "value": "515ffc6ed4514eafb14d3181456cbe30f4d11108",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-03T12:50:20+00:00",
            "last_seen": "2026-06-03T12:50:20+00:00",
            "object_relation": "sha256",
            "timestamp": "1783097013",
            "to_ids": true,
            "type": "sha256",
            "uuid": "1c43ffaf-1b1d-4078-a1d9-53fb200c654c",
            "value": "b3b63970833b3379ecec2d3ef8fea328fef8dd1c1574b1bcdfebad5bdce9280c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 04/07/2026\nLast-scan: 03/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-03T12:50:20+00:00",
            "last_seen": "2026-06-03T12:50:20+00:00",
            "object_relation": "text",
            "timestamp": "1783096132",
            "to_ids": false,
            "type": "text",
            "uuid": "2ce0b01d-6c4a-49ce-ae07-865af8536a75",
            "value": "Type Description: Google Chrome Extension\nMicrosoft: None\nClamAV: None\nVT Total Detection: 5/74\nFirst Submission: 2026-06-03T12:50:20+00:00\nLast Submission: 2026-06-03T12:50:20+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-03T12:50:20+00:00",
            "last_seen": "2026-06-03T12:50:20+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1783096132",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "35ad41e0-f6b4-40f5-9585-16f40f204498",
            "value": "98304:xkaZ7YjWc1LCG0WI60c1Pa8oyG2Jlt+jsqB4QBWxr5/CRv0pgHFD7zrJ59:uaBKLJpbd0SEIl+Wxr5KZKgHFvzr5"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-03T12:50:20+00:00",
            "last_seen": "2026-06-03T12:50:20+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1783096132",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "57e8691e-875c-42ff-a712-b37ca53e78e2",
            "value": "5870679"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-03T12:50:20+00:00",
            "last_seen": "2026-06-03T12:50:20+00:00",
            "object_relation": "filename",
            "timestamp": "1783096132",
            "to_ids": true,
            "type": "filename",
            "uuid": "f7d5b106-a98c-44db-b33d-265094535f83",
            "value": "jgpfgonjjolillilkjfkiddakagkkpoj.1.2.crx"
          }
        ]
      }
    ]
  }
}