FriarFox has been the only browser instance identified targeting FireFox browsers as an XPI file. It allows users to receive notifications and perform certain Gmail actions on up to five Gmail accounts that are actively logged in simultaneously. This is a free tool available on Github, the Mozilla Firefox Browser ADD-ONS store, and the QQ App store among other locations. It is largely based on an open-source tool named “Gmail Notifier (restartless)”. Gmail Access: Search emails, Archive emails, Receive Gmail notifications, Read emails, Alter FireFox browser audio and visual alert features for the FriarFox extension, Label emails, Marks emails as spam, Delete messages, Refresh inbox, Forward emails, Perform function searches, Delete messages from Gmail trash, Send mail from the compromised account.įireFox Browser Access – (Based on Granted browser permissions): Access user data for all websites, Display notifications, Read and modify privacy settings, Access browser tabs. The user must access the URL from a FireFox browser to receive the browser extension.Īdditionally, it appeared that the user must be actively logged in to a Gmail account with that browser to successfully install the malicious XPI file.Īfter the installation of the FriarFox browser extension, threat actors gain the following access to the user’s Gmail account and FireFox browser data included below. Threat actors appear to be targeting users that are utilizing a Firefox Browser and are utilizing Gmail in that browser. In this case, the domain is controlled by the threat actors, and the redirection is obtained via a malicious URL contained within a phishing email. The use of landing pages for JS redirection is a technique commonly used in watering hole attacks. XPI files are compressed installation archives used by various Mozilla applications and contain the contents of a FireFox browser extension. These scripts determine whether to deliver the malicious FireFox Browser extension (“.XPI” file) that Proofpoint has named “FriarFox”.

Once the URL is clicked, lead to a fake “Adobe Flash Player Update” themed landing page which executes several JavaScript (“JS”) files that profile the user’s system. The email contained the following malicious URL that impersonated YouTube: hxxps://you-tubetv/ The email was delivered from a known TA413 Gmail account that has been in use for several years, which imitates the Bureau of His Holiness the Dalai Lama in India. The email imitated the “Tibetan Women’s Association” in the From field and utilized the email subject “Inside Tibet and from the Tibetan exile community”. A phishing email was detected which targeted several Tibetan organizations in late January 2021.

Firfox facebook notifier