Ravindra BagaleCourses & study guides मराठी Track your progress

39. Malware Threats

39.2 How Malware Spreads

By Last updated:

Malware gharat yesayche common raste (Maharashtra SMB pan same pattern):

  1. Phishing email / WhatsApp link – fake invoice, "Courier delivery", "IT password reset"
  2. Drive-by – compromised / shady website silently drops payload (often via browser/plugin bugs)
  3. USB / removable media – autorun or user double-clicks salary_sheet.exe disguised as folder
  4. Supply chain – trusted update / vendor software already poisoned (rare but high impact)
  5. Cracked / pirated software – keygens and "full version" zip = trojan cafe
  6. Office macros – .docm / .xlsm "Enable Content" → script downloads payload

Lab awareness: tumhi phishing template awareness class madhe dakhavu shakta – pan real malware link click nako, real payload host var save nako.

Red team (attacker) does Blue team (defender) detects / stops
Sends invoice-themed phishing with macro or link Email filtering, attachment sandbox, disable macros by default, user reporting button
Leaves infected USB in parking (classic bait) Disable autorun; USB allowlisting / control; endpoint alerts on new removable media executables
Trojans cracked software on file-share sites Block unknown publishers; company software portal only; hash allowlists

Ravindra Bagale's Tip

Students say "I'm careful" and then install a cracked plugin on their personal Chrome. One weak home PC + a reused password = a risk to the office. Company rule: software only from the IT portal. Don't worry – changing a habit is protection.

Practice task

Raja-Rani Traders (Nashik) sathi 8-line user awareness notice Marathi+English mix: macros, USB, cracked apps, phishing. Mag Red vs Blue table madhun 3 spread methods pick karun "control + how we verify" column bhara.

Real incident: Emotet campaigns (public reporting)

Emotet was widely reported as a malware distribution botnet that often arrived via malicious Office documents and links, then dropped further payloads (including ransomware affiliates in later waves – per public vendor/CERT reporting). Weakness theme: macros + user click + weak email controls. Defence: block macros from internet, advanced email filtering, EDR, rapid isolation. Source: CERT-In / CISA / major vendor Emotet advisories (verify).

Extended teaching notes

Why this lesson matters

Malware analysis in this course is defensive: recognise indicators, isolate hosts, preserve evidence. Never run unknown malware on your main OS or on someone else's network.

  1. Isolate the host from the network.
  2. Capture volatile data if trained to do so.
  3. Hash samples; search only in licensed/safe tools.
  4. Rebuild from a known-good image when unsure.
  5. Share IOCs with your SOC, not on random chats.

Mini case study

Suppose we are on a purple-team exercise for an Indian mid-size company (sample data). Red notes a technique from this lesson against a lab clone. Blue must show the control that stops it, the log that would have fired, and the ticket that hardens production. That is the standard this course trains you for.

Defender's worksheet (do this today)

  1. Write the lesson title, date and the exact lab target you are allowed to use.
  2. List three owned systems (VMs, apps, or cloud accounts) where this lesson applies.
  3. Run one safe check from the lesson on a lab system only. Paste the command and output.
  4. Write a two-sentence fix you would give a teammate.
  5. Name one related public advisory (CERT-In, CISA, NVD, or a vendor bulletin) with its date.

Indian workplace (sample data)

Suppose we are a junior analyst at Infosys, TCS, Wipro or a fintech SOC in Bengaluru/Pune. Turn this lesson into one checklist item with an owner, a due date and a place to store evidence (ticket + screenshot).

Global practice

Compare your notes with OWASP, CIS Benchmarks, NIST CSF/IR guidance or a cloud Well-Architected security question. Write five lines on what overlaps.

Everyday analogy

Explain the risk and the fix to a family member without jargon. If they can repeat the warning, you understand it well enough to teach juniors.

Key terms

  • Control: a safeguard (patch, config, process, detection).
  • Finding: a weakness backed by evidence.
  • Remediation: the fix plus how you verified it.
  • Scope: systems you have written permission to touch.
  • Least privilege: only the access the task needs.
  • Defence in depth: several layers so one failure does not end the story.

Common mistakes

  • Skipping written permission "just for a quick scan".
  • Practising on hostel, office or public targets without authorisation.
  • Collecting tool output without writing the fix.
  • Copying attack steps onto production to "verify". Defenders verify with versions, configs and patches.
  • Publishing screenshots that contain secrets, cookies or internal hostnames.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.
  • Fix > spectacle.

Real incident: Searchjacked – 319 hidden Chrome extensions with 13.4 million installs took over people’s searches (Oct 2026)

1. What happened

In this lesson you learnt the ways malware reaches a computer. One quiet way is a browser extension. An extension (also called an add-on) is a small program you add to Chrome to give it an extra feature. Example: a button that converts files or blocks ads. A good extension helps you. A bad one can watch or change what you do in the browser.

  • On 29 October 2026, John Tuckner of the security company Socket published a report called Searchjacked. BleepingComputer reported it the same day.
  • Socket found 319 Chrome extensions with about 13.4 million installs in total. 57 of them, with 6 million users, were first found in April 2025. The new report added 264 more, with another 8.7 million users.
  • The extensions pretended to be file converters, manual finders, "safe search" tools and AI search tools. Many were security-themed, like Fire Shield, Securify and WatchTower.
  • Their real job was to take over the browser's default search engine. The default search engine is the site that answers when you type words in the address bar. Every search first went to the operators' own server, then to Bing or Yahoo. The operators earned referral money from Bing or Yahoo for each search.
  • The extensions were on the official Chrome Web Store, but many were unlisted, so they did not show up when you searched the store. People reached them through ads on websites.
  • Socket says a handful of organised operators were behind them, and this trick has run for about ten years. Most of the listed extensions were removed from the store when the report came out, but new ones keep appearing.

2. How the hack happened (public reporting only – high-level)

  1. A user saw an ad on a website for a "useful" tool, like a manual finder or safe search.
  2. The ad led to the extension's page on the Chrome Web Store. The user clicked Add to Chrome. Because it was the official store, it looked safe.
  3. The extension used a normal Chrome setting that lets an extension replace the default search engine. Some extensions had almost no code: only a settings file and icons, and no special permissions.
  4. From then on, every search went through the operators' server first. That server saw the complete search history, often linked to a unique ID for that user.
  5. The server then sent the search on to Bing or Yahoo with a partner tag, so the operators got paid.
  6. The server decides the final page for each search. In one test, six identical searches through one extension (Predator Search) ended in four different places. Socket warns the operators could switch some searches to a phishing page or a malware download at any time, without changing the extension at all.

3. How to stop it / defend (this lesson: how malware spreads)

Why: an extension runs inside the browser, where you log in to email, bank and work sites. One bad extension can see a lot, and the official store alone does not make it safe.

Controls you can use:

  1. Install extensions only when you really need them, and never from an ad. Go to the store yourself and check the publisher name.
  2. Remove extensions you do not recognise or do not use. Fewer extensions means fewer doors.
  3. Check your default search engine. If it is not the one you chose, find the extension that changed it, remove it, and set your search engine back.
  4. For companies: allow only an approved list of extensions through Chrome's admin policy, and block all others. Review the list every few months.
  5. Run a full antivirus scan after you remove a bad extension, as BleepingComputer advises.
  6. Teach people that "Add to Chrome" is the same as installing a program. Ask: who made it, why do I need it, and what can it change?

Example 1: see every extension in your Chrome. Run these steps one by one.

  1. Open Chrome and type chrome://extensions in the address bar. Press Enter.
  2. Output: a list of cards. Each card shows the extension name, a short description and an on/off switch.
  3. Click Details on one card. You see its version, its site access and where it came from.
  4. What it means: this is the full list of add-ons that run inside your browser. If you did not add one on purpose, or you do not use it, click Remove.

Example 2: check which search engine answers your searches.

  1. Type chrome://settings/searchEngines in the address bar and press Enter.
  2. Output: a section that shows your default search engine, for example Google or Bing.
  3. If an extension controls it, Chrome shows a note with that extension's name and a button to turn it off.
  4. What it means: if the default is a name you never chose, an extension took over your searches. Remove that extension and pick your search engine again.

Example 3: on your own Linux computer, find extensions that can replace the search engine.

  1. Close Chrome and open a terminal.
  2. Run grep -l "chrome_settings_overrides" ~/.config/google-chrome/Default/Extensions/*/*/manifest.json
  3. Output: zero or more file paths, like /home/asha/.config/google-chrome/Default/Extensions/abcdefgh.../1.0.2_0/manifest.json.
  4. What it means: each path is one extension whose settings file asks Chrome to override settings such as the search engine (chrome_settings_overrides). The long folder name is the extension ID. Match it with the ID on the Details page from Example 1, and keep it only if you trust it. No output means no extension asks for this. On Windows, the same folders are under %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions.

4. How to take care so it won't happen again (checklist)

  • [ ] I never install a browser extension from an ad or a pop-up.
  • [ ] Before I click "Add to Chrome", I check the publisher, the reviews and what the extension can change.
  • [ ] Once a month I open chrome://extensions and remove anything I do not use or do not recognise.
  • [ ] My default search engine is the one I chose, and no unknown extension controls it.
  • [ ] At work, only approved extensions are allowed by policy, and the list is reviewed regularly.
  • [ ] After removing a bad extension, I run a full antivirus scan and change passwords I typed while it was installed, if it could see those pages.

Source: Socket, "Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users" (John Tuckner), 29 October 2026; BleepingComputer, "Chrome extensions with 13.4 million installs caught hijacking searches" (Bill Toulas), 29 October 2026.

Check if you're safe: Phishing Link Checker