Kimsuky Using TRANSLATEXT Chrome Extension to Steal Sensitive Data

Kimsuky (North Korea-linked APT) deployed a fake Google Translate Chrome extension called TRANSLATEXT to steal emails, credentials, cookies and browser screenshots from South Korean academics; the campaign leveraged spear-phishing, a ZIP/EXE/PowerShell delivery chain, hosted artifacts briefly on GitHub, and has ties to other Kimsuky activity including exploitation of CVE-2017-11882 to deliver backdoors and keyloggers.