Question Need help finding samples of malicious Chrome extensions for research

[CyberDevil]

Guys, I'm currently considering (just considering for now) the idea of researching malicious Chrome extensions for my college thesis. Maybe you could suggest where I might find some samples? I suppose I could try to write something myself, but for a dataset, I need many more.

I would be very grateful for any sample, advice, or idea

I have a backup thesis topics (secure DNS or computer vision), but I like it much less.

 

[Bot]

That's an interesting topic for your college thesis! When it comes to finding samples of malicious Chrome extensions, one option is to search for research papers or reports that have previously analyzed and documented such extensions. These resources often provide downloadable samples for further analysis.

Another approach is to search for repositories or online platforms that host Chrome extensions, such as the Chrome Web Store or GitHub. While there are legitimate extensions available, you might be able to find some samples that have been identified as malicious or suspicious.

Additionally, you could consider reaching out to researchers or experts in the field who may have access to such samples or can provide guidance on where to find them.

Good luck with your research!

 

[Sandbox Breaker - DFIR]

I would recommend you take a look at searching for CRX artifacts on public sandboxes. The below is file I found that installed a malicious chrome extension. This file fooled a MS Threat Analyst.

Malware Analysis - Evasive Sample - Bypassed MS

Signed sample pretending to be TeamViewer. It is a password stealer. As a DFIR Specialist it's easy to me. After submitting the sample to Microsoft... They said the file was clean. File has been in the wild for a week now. Welcome to the current state of insecurity. Happy hunting! VirusTotal

malwaretips.com

Hope this helps!

 

[CyberDevil]

I would recommend you take a look at searching for CRX artifacts on public sandboxes.

Can you advise which sandboxes you're talking about? I couldn't find any .crx on any run, also hybrid-analysis has only two malicious .crx, as I see it , I don't know any other sources where it would be possible to download a sample.

 

[partha_roy]

If possible, you may consider researching malicious codes in general rather than specifically researching malicious extensions; you can try MalwareBazaar to collect the samples

 

[Sandbox Breaker - DFIR]

Can you advise which sandboxes you're talking about? I couldn't find any .crx on any run, also hybrid-analysis has only two malicious .crx, as I see it , I don't know any other sources where it would be possible to download a sample.

Triage, bazaar (as mentioned), and old fashioned searching for warez will result in malicious seo results. Sometimes you got to steer the paved road into the beaten path (wild)

 

[cartaphilus]

Don't discount searching usenet for samples. Many whipper snappers use torrents etc but the old arse cautious folks still use.... usenet. And that's where the more robust samples lay. Also searching for drugs on a dark web also helps.