Shampoo

"Shampoo" is a malware campaign identified in August 2023, as reported by Check Point Research. The malware targets users of the Chrome browser through the spread of malicious browser extensions via fake advertisements. Victims are tricked into running VBScript files that install these harmful extensions. The research on this threat was conducted using VirusTotal and has been documented extensively on SensorsTechForum.com, which also provides a guide for removing the Shampoo ChromeLoader from infected systems. The malware's infection chain involves an unusual method of propagation. Users are enticed to play an online game where they can win discounts on products such as Flake Free Shampoo. Upon winning, users receive a QR code leading them to the product page on a website called "Pretty Girl Shopping." This site offers various items and encourages users to sign up for a credit card, further increasing their risk exposure. Despite the apparent novelty of the products and the allure of discounts, the true purpose of the website and the game is to facilitate the spread of the Shampoo malware. The security implications of this scheme are significant, as it demonstrates a new way in which cybercriminals can exploit unsuspecting users. It underscores the importance of maintaining robust cybersecurity measures, including being cautious about suspicious downloads and websites, to mitigate the risk of such malware infections.