ABCsoup: The Malicious Adware Extension with 350 Variants

Zimperium analyzed the 'ABCsoup' campaign: over 350 variants of malicious browser extensions that reuse the Google Translate extension key to appear legitimate, are sideloaded via Windows executables, and inject obfuscated JavaScript into pages to collect personal and social-media data, serve personalized ads, and potentially exfiltrate keystrokes/cookies; the report includes detailed TTPs, attribution to Eastern European/Russian actors, and extensive IoCs (numerous C2 domains and many EXE hashes).