What is the attack?FortiGuard Lab’s EDR team recently identified malware infection exhibiting strong similarities to the previously reported Genesis Market malicious campaign that was dismantled by law enforcement in early 2023. The investigation traced some initial compromises to tools used for circumventing software licensing and counterfeit GPG MSI installers embedded with PowerShell scripts. Following the initial infection, the malware deploys a victim-specific DLL into the machine’s memory. This malware targets Edge, Chrome, Brave, and Opera browsers by installing a “Save to Google Drive” extension, which it uses to steal login credentials and sensitive personal data.What is Genesis Market?Genesis Market is a black market that deals in stolen login credentials, browser cookies, and online fingerprints. Its operation involves infecting victims, extracting data from their browsers, and maintaining persistence on the victim’s machine to steal new data. Although law enforcement agencies dismantled it in the first half of 2023, recent traces of infections suggest a possible attempt to revive its operations. What is the recommended Mitigation?Maintain general awareness and training about the risk of phishing and social engineering attacks. Ensure that all systems and software are kept up-to-date with the latest patches. Organizations can raise the security awareness of their employees that are being targeted by phishing, drive-by download and other forms of cyberattacks using Security Awareness Training.What FortiGuard Coverage is available?FortiEDR in full prevention mode prevents these attacks from propagating onto the machine pre-infection and can prevent exfiltration of data. FortiGuard AV service detects and blocks all the known malware and Web Filtering service has blocked all the known IoCs related to the campaign.
