Analysis Summary

Rilide, a sophisticated browser-based malware, has emerged as a major threat targeting Chrome and Edge users through deceptive browser extensions. It primarily spreads via phishing emails containing fake browser update links or compromised websites that trick users into installing the malicious extension. Once installed, Rilide requests extensive permissions, enabling it to monitor browser activity, intercept form submissions, and establish persistence by creating a background service worker that remains active even after a browser restart. Security researchers have identified this malware in active campaigns across North America and Europe, with widespread credential theft incidents reported at financial institutions and e-commerce platforms.

The malware exhibits advanced obfuscation techniques to bypass browser security checks and extension verification, making detection highly challenging. It communicates with multiple command-and-control (C2) servers using encrypted protocols, as discovered by Researcher, who tracked unusual data exfiltration patterns. Rilide has the capability to capture login credentials from over 300 websites, including banking portals and cloud services, making it particularly dangerous for corporate environments. Once an account is compromised, attackers can leverage lateral movement within a network, increasing the severity of the breach. The infection has already resulted in approximately 75,000 installations worldwide since its discovery in early March.

Rilide’s infection mechanism relies on extensive permission requests in its manifest file, including access to tabs, storage, web requests, cookies, and background script execution. The credential theft functionality is embedded in the content script, which injects event listeners to capture user input before encryption, effectively bypassing HTTPS security. This allows attackers to steal login credentials in real-time before they are securely transmitted. Additionally, the malware includes dormancy features to evade detection, as well as mechanisms to detect security analysis environments and alter its behavior accordingly.