CISA/FBI/USCYBERCOM advisory AA20-301A (North Korean APT Focus: Kimsuky)
Kimsuky malicious Google Chrome Web Store extension stealing passwords and cookies · 2018
In 2018, Kimsuky used an extension, which was available on the Google Chrome Web Store, to infect victims and steal passwords and cookies from their browsers ( Man-in-the-Browser [ T1185 ]).