Browser Hijacking: Analysis of Three Techniques

Summary

The article explores three different techniques used by browser hijackers to manipulate user browsers on Windows. It covers direct tampering with browser preference files, scripted keypress emulation that remotely drives the browser UI, and misuse of Chromium command-line switches to sideload malicious extensions. Each method is accompanied by representative artifacts and code examples. The primary objective of these hijacks is ad-injection and unauthorized redirection, rather than credential theft or direct data exfiltration.

Investigation

The researcher reviewed malware associated with the TamperedChef/BaoLoader campaigns and identified a native module, UtilityAddon.node, leveraged to collect system identifiers and alter Firefox and Chrome preference files. A second sample showcased a browser remote access tool (BRAT) that fakes keyboard shortcuts to change the address bar, spawn new tabs, and generate fraudulent ad clicks. The third scenario involved a VBS/PowerShell-based hijacker that sets up scheduled tasks, monitors process creation via WMI, disables Chrome updates, and forces a rogue extension to load through a now-deprecated Chromium command-line switch.

Mitigation

Defenders should remove or quarantine hijacker components such as UtilityAddon.node, malicious .reg entries, and suspicious PowerShell scripts. Disable or delete scheduled tasks that invoke unknown or untrusted scripts. Restore browser preference files from known-good backups and apply strict file permissions. Monitor or block attempts to use the legacy Chromium –load-extension switch and verify that Chrome’s automatic update mechanisms remain enabled.

Response

On detection, look for the artifacts described and track changes to browser preference files, registry values that interfere with updates, and atypical browser command-line parameters. Isolate impacted machines, capture volatile evidence, and perform a thorough review of installed and actively loaded extensions. Use automated remediation scripts to reset browser settings to secure defaults and re-enable update services. Finally, monitor any related network indicators that could signal command-and-control activity.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

• Attack Narrative & Commands:
  The adversary has previously dropped a malicious PowerShell script named configuration.ps1 into %LOCALAPPDATA%DiagnosticNET. The script continuously monitors for browser processes (Chrome, Edge, Firefox) and terminates them, forcing the user’s browser to restart and load a malicious extension the attacker previously placed in the user’s profile. To trigger the detection, the attacker launches the script via a direct PowerShell call:

  1. Create the hidden folder and drop the malicious script.
  2. Execute the script with powershell.exe using a clear‑text command line that matches the rule’s condition.
  3. The script logs its activity to the console (for demo purposes) and kills the target browsers.

• Regression Test Script:

  # ---------------------------------------------------------
  # Regression script – reproduces the detection‑triggering activity
  # ---------------------------------------------------------
  
  # 1. Prepare the hidden directory
  $targetDir = "$env:LOCALAPPDATADiagnosticNET"
  if (-not (Test-Path $targetDir)) {
      New-Item -Path $targetDir -ItemType Directory -Force | Out-Null
      # Hide the directory
      (Get-Item $targetDir).Attributes = 'Hidden','Directory'
  }
  
  # 2. Drop the malicious configuration.ps1
  $scriptPath = Join-Path $targetDir "configuration.ps1"
  @'
  # Malicious configuration script – terminates browsers
  $browsers = @("chrome", "msedge", "firefox")
  foreach ($proc in $browsers) {
      Get-Process -Name $proc -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue
  }
  Write-Output "Browser processes terminated."
  '@ | Set-Content -Path $scriptPath -Encoding UTF8
  
  # 3. Execute the script via PowerShell – this should fire the Sigma rule
  $cmd = "$env:WINDIRSystem32WindowsPowerShellv1.0powershell.exe -ExecutionPolicy Bypass -File `"$scriptPath`""
  Write-Host "Executing malicious script:" $cmd
  & $env:WINDIRSystem32WindowsPowerShellv1.0powershell.exe -ExecutionPolicy Bypass -File $scriptPath

• Cleanup Commands:

  # ---------------------------------------------------------
  # Cleanup – removes artifacts created by the regression test
  # ---------------------------------------------------------
  
  # Stop any stray browser processes that may have been terminated
  # (No action needed – browsers can be restarted manually)
  
  # Remove the malicious script and hidden folder
  $targetDir = "$env:LOCALAPPDATADiagnosticNET"
  if (Test-Path $targetDir) {
      Remove-Item -Path $targetDir -Recurse -Force
  }
  
  # Optionally, clear PowerShell command‑line history
  Clear-History