Incident Response, Malware, TDR, Vulnerability Management

Malware disguised as Firefox add-on ensnares users in botnet

Malware disguising itself as a Firefox add-on has ensnared more than 12,500 PCs in a botnet that, since May, has uncovered more than 1,800 vulnerable websites, technology journalist Brian Krebs wrote on Monday. He added that a component to steal sensitive information exists, but does not appear to be active.

Although it is unclear how the botnet – known as Advanced Power – initially spread, what is known is that infected Firefox users are unknowingly hitting almost every website they visit with SQL injection attacks. Text strings in the malware suggest the author may be from Czech Republic, Alex Holden, CISO at Hold Security, was quoted as saying.

SQL injection typically involves an attacker inputting SQL statements into an entry field that will force the system to execute potentially malicious commands.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.