I’ve been working through a lot of work cycles because of koi.ai blog posts that assert malicious behavior from browser/IDE extensions and I just can’t shake the ick that I get from these articles.
As an example: 4.3 Million Browsers Infected: Inside ShadyPanda's 7-Year Malware Campaign
Aside from the biggest ick I get that is “this article is very clearly AI generated”, I see just a ton of red flags in all of these articles that I read.
- Attention grabbing clickbait title
- Excessive use of the phrase “RCE” and “Backdoor” without evidence of remote code execution or backdoor usage.
- Screenshots of code with basic or over-simplified analysis
- Made up Threat Actor names based on CrowdStrike naming conventions (“ShadyPanda” is probably a lawsuit waiting to happen)
I have reviewed the code and behavior of some of the extensions they’ve mentioned in the past and did find evidence of unusual network traffic and suspicious coding patterns that could be abused, but that doesn’t necessarily validate the urgency they assert. If I were to do the same thing with Adobe Acrobat I am sure I would find unexplained network traffic to Adobe owned servers and upon analysis of their code I am sure I would find segments that could be interpreted as allowing for RCE or a backdoor… but that doesn’t mean Adobe Acrobat is malware.
Is it too much to ask a vendor to show a link between “RCE is possible” and “RCE was used in this specific IR we worked”?