Chromeloader

ChromeLoader, first identified in early 2022, is a malicious software (malware) that primarily targets browsers to steal sensitive information and execute additional payloads, usually involving other malware families. The malware has been notably used in fake ROBLOX and Nintendo game cracks, which were reported on various cybersecurity platforms. In its most recent variants, ChromeLoader has evolved to utilize Electron, a framework for creating desktop applications using web technologies such as HTML and JavaScript. This indicates that the attackers are highly skilled with this technology, as evidenced by the heavily obfuscated loader scripts embedded within the Electron application. The malware has been involved in several significant cybersecurity threats, including the Charcoal Stork malvertising campaign that delivered the SmashJacker and ChromeLoader browser hijackers. This campaign affected nearly 15% of Red Canary customers, making it one of the most severe threats of the previous year. ChromeLoader operates as a malicious browser extension that redirects users to unwanted websites, often promoting advertisements or malicious content. In 2023, ChromeLoader was the most prevalent malware family, followed by MedusaLocker and Redline Stealer. It has been widely reported in the context of posing as mods for popular platforms like Steam and Nintendo games. These developments underscore the sophistication and adaptability of the malware, emphasizing the need for robust security measures and user awareness to prevent infection.