1st August – Threat Intelligence Report · 2022-08-01
A North-Korea affiliated actor named SharpTongue (aka Kimsuky) has been spotted in a new campaign stealing Gmail and AOL users’ webmail. The actor is leveraging a malicious browser extension called SHARPTEXT that is supported on Chrome, Edge and Whale.
Foreign policy, nuclear and other individuals of strategic interest in the United States, Europe, and South Korea · 28/07/2022
Researchers from Volexity reveal the details of the latest campaign by the North Korean threat actor Kimsuky, using SHARPEXT, a malicious browser extension to steal emails from Google Chrome or Microsoft Edge users. [Date Occurred: Since at least September 2021; Date Discovered: During September 2021]
SharpTongue SHARPEXT mail-stealing browser extension incidents (since September 2021) · 2022-07-28T09:39:56+00:00 (published_time)
However, in September 2021, Volexity began observing an interesting, undocumented malware family used by SharpTongue. Within the last year, Volexity has responded to multiple incidents involving SharpTongue and, in most cases, has discovered a malicious Google Chrome or Microsoft Edge extension Volexity calls “SHARPEXT”.