Malware steals Chrome session cookies to take over your accounts

A phishing email delivers a disguised JavaScript attachment (.pfd.js) that drops files and triggers a chain installing a malicious Chrome extension with a native host. The extension and native application use Chrome native messaging to run PowerShell, collect cookies, tabs and fingerprints, enable remote commands, and allow session hijacking and potential data exfiltration; the report lists specific IOCs (filenames, extension ID, domain) and provides mitigation advice.