Chrome Extension Steals Credentials of Bank Customers

This analysis details a Delphi Trojan that drops and activates a malicious Chrome extension (masquerading as "Google Secure Web") to steal cookies and login credentials from Banco do Brasil customers. The malware downloads obfuscated extension files, alters Chrome shortcuts to load the extension, disables Chrome's developer-mode warnings via a batch script, sets a malicious proxy to route victim traffic through attacker infrastructure, injects scripts to intercept specific bank login actions, exfiltrates session cookies and captured credentials to attacker-controlled endpoints, and includes MD5 hashes and network IOCs.