RIFFSEC

Gorąca prośba. Jeśli używacie informacji które tu podajemy to warto jest linkowac lub podawać źródło ;)

🧩 Are you keeping an eye on your browsers? The screenshot shows one of the campaigns we’ve been tracking recently. It involved 319 Chrome extensions, 13.4 million installs, and the hijacking of users’ searches. We’re writing about it precisely because it’s so typical. And once again, it exposes a blind spot. Most organisations leave browser extensions out of their threat models altogether. We have application policies, EDR, proxies, and controls over what gets installed on endpoints. Yet with a single click, an employee can add third-party code to their browser and grant it permission to read and modify data on every site. In practice, that code can run inside any web app they open, whether it’s their email, CRM, or an internal system. For an attacker, that’s an ideal position. An extension with broad permissions can read session cookies and tokens issued after the user signs in. That makes it possible to hijack a session and bypass MFA because the user has already authenticated. The extension can also alter page content, intercept form submissions, and redirect traffic. It can do all of this from within a trusted process on a device that has passed every access check. The second issue is the supply chain. An extension you vet on the day it’s installed can receive new code six months later through an automatic update. All it takes is a change of ownership or a compromised developer account. Popular extensions with large user bases are regularly bought and sold. The Cyberhaven incident in late 2024 showed how this can play out. After a phishing attack compromised a developer account, users received a malicious update directly from the Chrome Web Store. Nobody had to click ‘Allow’ a second time. The way official stores review extensions before listing them leaves plenty to be desired, too. The third issue is detection. The traffic comes from a legitimate browser, travels over HTTPS, and often goes to domains with a neutral reputation. To an EDR tool, it looks like an ordinary Chrome process. To a proxy, it looks like routine web traffic. That’s how campaigns like this can run for years. They already have all the permissions they need from day one. So before asking ‘Do we have a malicious extension?’, organisations need to ask ‘Do we even know which extensions are installed and what permissions they have?’ Without an inventory and an allowlist enforced through browser policies, you can’t assess the risk. You’re left hoping nothing happens. Are you willing to put that much faith in luck? 😶

🚨 Two Critical Vulnerabilities in PHP The PHP Security Team has announced an emergency security release addressing two critical vulnerabilities, reportedly identified as CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities carry a CVSS v4.0 score of 9.2 and, according to preliminary security research, may allow unauthenticated Remote Code Execution (RCE). Key findings: • Affected product: PHP • Severity: Critical (CVSS 9.2) • Potential impact: Remote Code Execution (RCE) • Patch release: October 21, 2026, at 14:00 UTC • Affected versions: Not yet officially disclosed • Active exploitation: No confirmed cases reported Although active exploitation has not been confirmed, the potential impact and widespread use of PHP across internet-facing applications make these vulnerabilities a significant security concern. Organizations should identify exposed PHP environments, prepare for immediate patch deployment, and increase monitoring for suspicious activity. The disclosure of technical details may accelerate exploit development, potentially reducing the time available for remediation. Read our latest CTI Note for further technical analysis, threat assessment, and recommended mitigation measures: #RSCTINote

A vending machine. You drop in a few dollars, out comes a crime. A DDoS attack from 5 dollars an hour. A ready made infostealer on subscription. Someone's online banking login. A money mule for laundering, 30% commission. This is not theory. This is a price list. Crime has become a service. Packaged, priced and delivered like any other product. The whole market runs like a factory: someone builds the tools, someone sells them, someone handles the customer. At @RIFFSEC we took that factory apart. What sits on the shelves, what it costs and why it keeps running. Crime as a Service. October 2026. #CrimeAsAService #ThreatIntelligence