Threat Actors Exploit Office Assistant to Deliver Malicious Mltab Browser Plugin

QiAnXin's RedDrip Team disclosed a supply-chain malware campaign (observed since May 2024) that abuses Office Assistant v3.1.10.1 to load digitally-signed malicious components which deploy the Mltab (MadaoL Newtab) browser extension; the extension hijacks new tabs, redirects user traffic, and exfiltrates browsing and device data. The campaign has large scale impact (reporting nearly one million compromised endpoints and over 210,000 extension installations), uses multiple C2 domains and persistence mechanisms, and remains available via official add-on stores; organizations should verify Office Assistant versions, inspect/remove unauthorized extensions, and apply endpoint detection/remediation.