Rilide Malware Enables Hackers to Bypass 2FA and Steal Crypto

A new malware strain called Rilide has been discovered, which is designed to attack web browsers built on the Chromium platform. It camouflages itself as a legit Google Drive extension to evade detection and leverages inherent Chrome features for malicious purposes. Rilide can monitor browsing history, take screenshots, and inject malicious scripts. It can also exploit counterfeit dialogs to trick users into disclosing their two-factor authentication information, which it then employs to steal cryptocurrencies covertly. The malware bypasses the Content Security Policy feature of a web browser and can capture screenshots and exfiltrate browsing history, which is then transmitted to the attacker’s command-and-control server.