Native-messaging bridge (com.lunex.explorer) file creation for browser extension

Ibrahim Saud@tektrix

•updated 7 days ago•0•0•0

Detects the creation of files associated with Psychedelic Stealer's persistence mechanism. The malware establishes persistence by installing a malicious native messaging host configuration file (com.lunex.explorer.json) and associated malicious scripts (host.ps1 or host.bat), which allows it to intercept and manipulate web browser native messaging.