North Korean Hackers Utilizing Malicious Browser Extension to Surveillance Email Accounts, Cybersecurity Experts Warn

A malicious browser extension capable of stealing email content from Gmail and AOL accounts has been deployed by a threat actor with aligned interests with North Korea.

German and South Korean intelligence agencies issued Joint Cybersecurity Advisory, alerting Kimsuky’s use of Chrome extensions to Illicitly access Gmail emails of targets.

North Korean threat group Kimsuky expands spear phishing operations to target diplomats, journalists, and government agencies in the USA and Europe. Cybersecurity experts issue joint security advisory warning of North Korean hacking group’s use of malicious chrome extension and android applications in two attack methods.

Malware linked to North Korean threat group Kimsuky by cybersecurity firm Volexity, attributed to SharpTongue activity cluster with similar overlaps. SharpTongue activity cluster has a track record of targeting individuals working on sensitive topics involving North Korea and nuclear issues in the USA, Europe, and South Korea.

Named ‘AF’, a malicious chrome extension used by North Korean hackers can only be detected in the browser extension list by entering the specific address, cybersecurity experts find.

Upon accessing Gmail through the infected browser, the ‘AF’ extension activates automatically and illicitly intercepts and steals the victim’s email content, cybersecurity experts caution.

The extension abuses the browser’s Devtools API (developer tools API) to send the stolen data to the attacker’s relay server, secretly stealing their emails without breaking or bypassing account security protections. Kimsuky has a history of exploiting malicious chrome extensions to steal emails from compromised systems.

Months after Kimsuky actor employed Konni Rat to target political institutions in Russia and South Korea, new research links hacking group to malicious chrome extension ‘AF’ used for stealing email content from compromised Gmail accounts, reports the cybersecurity firm.

To mitigate the risk of cyber attacks, experts recommend regularly updating software, exercising caution when opening unexpected emails or links, and conducting periodic monitoring of accounts to identify and respond to suspicious activity.