Kimsuky Deploys TRANSLATEXT Chrome Extension

This report analyzes a Kimsuky campaign that delivered a malicious archive containing decoy HWP documents and a Windows executable which retrieves PowerShell stages; the actor also uploaded a malicious Chrome extension (masquerading as Google Translate) to GitHub that injects scripts to bypass login protections, harvest email/passwords, cookies, and take screenshots, using a public blog as a dead-drop C2 and registry keys to enforce extension installation.