ClickFix Series: Malicious Browser Extension Silently Registered for Real-Time C

Ibrahim Saud@tektrix

•updated 8 days ago•0•0•0

Detects potential credential theft or malicious browser extension installation (DeepLoad-style) by monitoring for browser extension manifest file drops or registry-based extension force-installs occurring shortly after suspicious PowerShell command execution (ClickFix-style) on the same device.