Cyritex Security Lab | The latest Chrome information stealer has been added to our breach and attack simulation library!

Recently, Chrome has been found to have a high-severity zero-day vulnerability tracked as "CVE-2022-2294". This is a high-severity exploit existing in the WebRTC component that can lead to heap-based buffer overflow. On 5 July, Google released the emergency update 103.0.5060.114. Users can apply the patch for remediation by updating via "About Google Chrome" under the Help menu.

However, SHARPCHROME, the latest tool designed to steal login credentials and cookies stored in Chrome, has also begun to circulate. Although this tool does not currently exploit this latest zero-day vulnerability, it still poses an extremely high risk.

▌Introduction to SHARPCHROME

SHARPCHROME is a specific implementation of SharpDPAPI for Chrome, enabling malicious attackers to use this tool to extract, decrypt, and triage cookies and login credentials saved in Chrome. According to the analysis by the Sixun Security Lab, this process is actually an adaptation of Mimikatz. SharpDPAPI is a C# port of some DPAPI functionality from @gentilkiwi's Mimikatz project. Both Chrome and newer Chromium-based Edge browsers can be triaged using SharpChrome. Therefore, its impact is not limited to the Chrome browser; even the Edge browser is not immune.

▌Attack Simulation Library Update

You can now select the attack techniques based on this information-stealing tool within our platform. These can be used to run attack simulations as a non-administrator user inside our AI offensive and defensive bots running different Windows versions (Windows 7/Windows 10/Windows 11/Windows Server 2016) to test the detection and prevention capabilities of your endpoint/host defences against this tool itself and its behaviours.

Regardless of whether you have updated to the latest version of the Chrome or Edge browser, you need your endpoint/host defences to possess detection and prevention capabilities against this tool. This ensures that malicious attackers cannot successfully use this tool to achieve their information theft objectives during the information gathering or credential access stages of the attack process.