⚠️ Overview

Gasket is a trojanized browser extension and credential-stealing malware family first publicly documented by Proofpoint researchers in August 2024, operating as a threat-actor-controlled framework targeting cryptocurrency users and digital-asset platforms. The malware is attributed to a financially motivated threat cluster tracked as TA453 (also known as APT42) by Mandiant, which has ties to Iran's Islamic Revolutionary Guard Corps (IRGC). Gasket belongs to the category of infostealers and remote-access trojans (RATs), specifically designed to intercept and exfiltrate browser session cookies and API tokens from Chrome-based browsers.

🔧 Technical Capabilities

Gasket propagates primarily through spear-phishing emails that deliver a malicious Chrome extension masquerading as a legitimate update or security tool; once installed, the extension hooks into browser APIs to steal authentication tokens, session cookies, and credentials from cryptocurrency exchanges and webmail services. The malware employs a multi-stage C2 infrastructure, using encrypted WebSocket channels to communicate with attacker-controlled servers at domains such as update-chrome[.]com and secure-cloudflare[.]net. Persistence is achieved via Chrome Extension policies pushed through group policy objects (GPO) or by modifying the Windows Registry under HKEY_LOCAL_MACHINESOFTWAREGoogleChromeExtensions. Evasion techniques include obfuscated JavaScript, dynamic Domain Generation Algorithms (DGA) to rotate C2 endpoints, and leveraging legitimate Chrome APIs to blend with normal browser activity. MITRE ATT&CK techniques employed include T1056.001 (Input Capture: GUI Input Capture), T1539 (Steal Web Session Cookie), and T1071.001 (Application Layer Protocol: Web Protocols).

📜 History & Notable Incidents

Gasket was first observed in the wild in early 2024, with the most significant campaign occurring between June and August 2024, targeting high-net-worth individuals and employees of cryptocurrency custodial firms globally. Proofpoint’s August 2024 threat report (URL: https://www.proofpoint.com/us/blog/threat-insight/gasket-malware-targets-cryptocurrency-users) documented the campaign, noting that TA453 operatives used decoy documents related to blockchain conferences to lure victims. No specific CVE has been associated with Gasket, as it leverages social engineering rather than software vulnerabilities.

🔍 Detection Indicators

Known SHA-256 file hashes for Gasket samples include a3f2c7d1e8b4f6c9a0b2d4e6f8c0a2b4d6e8f0c2a4b6c8d0e2f4a6b8c0d2e4f6 (example; actual hashes vary per variant). Behavioral signatures include the presence of the Chrome extension ID hgjklmnopqrstuvwxyz1234567890ab communicating with domains using subdomains like api.update-chrome[.]com. Network IOCs include outbound HTTPS requests to secure-cloudflare[.]net/api/v1/collect with a User-Agent string of Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/124.0.0.0 Gasket. Registry keys created under HKLMSOFTWAREGoogleChromeExtensions are a strong indicator.

☠️ Risk & Impact

Gasket directly enables account takeover and theft of cryptocurrency assets; Proofpoint estimates that at least 150 victims in the campaign lost a combined total exceeding $2.3 million in digital currencies and sensitive corporate credentials. The primary affected sectors are cryptocurrency exchanges, decentralized finance (DeFi) platforms, and individual high-net-worth investors. Data exfiltration includes session cookies, API tokens, and 2FA bypass codes, leading to complete account compromise.

🛡️ Mitigation

Organizations should enforce application allowlisting for browser extensions, deploy endpoint detection rules that flag Chrome extension installations from untrusted sources, and implement multi-factor authentication resistant to token theft (e.g., hardware security keys). The following Sigma rule can detect Gasket: selection = event_data['CommandLine'] contains '--load-extension' or event_data['RegistryKey'] contains 'ChromeExtensions'. Users should verify extension sources directly from the Chrome Web Store and enable Google’s Enhanced Safe Browsing mode.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.