{ "intelligence": { "actors": [], "counts": { "actors": 0, "associated_entity_contexts": 0, "deduplicated_iocs": 3, "direct_entities": 15, "direct_relationships": 29, "invalid_iocs": 0, "iocs": 3, "mentioned": 4, "mitre_associated": 0, "mitre_direct": 0, "targets": 1, "techniques": 0, "unsupported_indicators": 4, "vulnerabilities": 0 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 56, "excluded_graph_objects": 110, "graph_complete": true, "graph_objects": 15, "graph_relationships": 29, "mitre_context_complete": true, "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "status_as_of": "2026-10-10T11:23:45+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.664Z", "created_at": "2026-09-26T04:25:42.604Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-26T04:25:42.921Z", "updated_at": "2026-09-26T04:25:42.921Z" }, "description_available": false, "entity_type": "Malware", "id": "0cfd4994-a0bd-45c8-b5a4-2c8368ae80a2", "is_inferred": false, "labels": [], "lang": "en", "name": "VREO", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "malware--af4fd120-96cf-549f-b7c5-9c15a82ed3b2", "type": "Malware" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T04:25:47.229Z", "updated_at": "2026-09-26T04:25:48.898Z" }, "description_available": false, "entity_type": "Hostname", "id": "0f457142-e38b-47d7-92db-d4e80e31e93a", "is_inferred": false, "labels": [ "browser extension malware", "chrome extensions", "cryptocurrency theft", "firefox extensions", "j7tracker", "vreo" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "hostname--f1003f5f-849b-5978-b773-11d98bf0775e", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.720Z", "created_at": "2026-09-26T04:25:47.480Z", "modified": "2026-09-26T04:25:53.001Z", "updated_at": "2026-09-26T04:25:53.001Z" }, "description_available": false, "entity_type": "Indicator", "id": "13f2a4dc-4bc9-45fc-b456-f85ba7213619", "is_inferred": false, "labels": [ "browser extension malware", "chrome extensions", "cryptocurrency theft", "firefox extensions", "j7tracker", "vreo" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "indicator--5e1dcb0a-5cc5-5e75-9e82-5eddffb6da68", "type": "Indicator" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.666Z", "created_at": "2026-09-26T04:25:43.399Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-26T04:25:43.756Z", "updated_at": "2026-09-26T04:25:43.756Z" }, "description_available": false, "entity_type": "Malware", "id": "33f33982-9158-49ba-bb1f-02e4d7d4fd9a", "is_inferred": false, "labels": [], "lang": "en", "name": "GhostApe", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "malware--77ffd73f-34eb-5822-b2c7-bed721ada4ca", "type": "Malware" }, { "__typename": "Sector", "aliases": [ "Financial", "Financial Industry (FI)", "Financial Services", "Financial-Services" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.391Z", "created_at": "2026-01-18T14:35:07.063Z", "modified": "2026-01-22T20:49:24.280Z", "updated_at": "2026-01-22T20:49:24.280Z" }, "description_available": true, "entity_type": "Sector", "id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "is_inferred": false, "labels": [], "lang": "en", "name": "Finance", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "identity--283d4ea0-b6f1-5421-bdab-117a33fdb2b7", "type": "Sector" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T04:25:47.118Z", "updated_at": "2026-09-26T04:25:47.699Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "6a9b9772-9fd5-4e09-bece-2ba52323f3e9", "is_inferred": false, "labels": [ "browser extension malware", "chrome extensions", "cryptocurrency theft", "firefox extensions", "j7tracker", "vreo" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "domain-name--95e13057-d627-5ae8-a4bd-fc0f46067c2c", "type": "DomainName" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.665Z", "created_at": "2026-09-26T04:25:42.652Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-26T04:25:42.922Z", "updated_at": "2026-09-26T04:25:42.922Z" }, "description_available": false, "entity_type": "Malware", "id": "7fa22b5f-914c-422a-9d1c-da4a9dff9711", "is_inferred": false, "labels": [], "lang": "en", "name": "Orbit Tracker", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "malware--f5c67124-4fc5-564a-b299-654f8c3250af", "type": "Malware" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.729Z", "created_at": "2026-09-26T04:25:50.812Z", "modified": "2026-09-26T04:26:00.938Z", "updated_at": "2026-09-26T04:26:00.938Z" }, "description_available": false, "entity_type": "Indicator", "id": "875d7522-3298-4680-8e48-4f7a589fff5b", "is_inferred": false, "labels": [ "browser extension malware", "chrome extensions", "cryptocurrency theft", "firefox extensions", "j7tracker", "vreo" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "indicator--08b54f5e-c053-5ac3-879d-f5d70965b2c1", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.734Z", "created_at": "2026-09-26T04:25:50.894Z", "modified": "2026-09-26T04:26:05.798Z", "updated_at": "2026-09-26T04:26:05.798Z" }, "description_available": false, "entity_type": "Indicator", "id": "9547ebec-20a1-4430-89e6-1b4317d03373", "is_inferred": false, "labels": [ "browser extension malware", "chrome extensions", "cryptocurrency theft", "firefox extensions", "j7tracker", "vreo" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "indicator--bc162448-6282-5220-bcc8-5af4ff5ff8a6", "type": "Indicator" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T04:25:46.304Z", "updated_at": "2026-09-26T04:25:46.582Z" }, "description_available": false, "entity_type": "Hostname", "id": "95d1a98d-7e8a-48da-b091-ba94da66fcd3", "is_inferred": false, "labels": [ "browser extension malware", "chrome extensions", "cryptocurrency theft", "firefox extensions", "j7tracker", "vreo" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "hostname--d75afee7-e07c-5d6e-b901-15cf3ed7e0b5", "type": "Hostname" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T04:25:45.614Z", "updated_at": "2026-09-26T04:25:46.440Z" }, "description_available": false, "entity_type": "StixFile", "id": "d7d80d7b-d254-487f-9ccd-6f26d2652e54", "is_inferred": false, "labels": [ "browser extension malware", "chrome extensions", "cryptocurrency theft", "firefox extensions", "j7tracker", "vreo" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "file--bd378df8-e5e6-5239-bd60-e413b9c66a26", "type": "StixFile" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T04:25:45.643Z", "updated_at": "2026-09-26T04:25:46.581Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "e71b6aa1-a254-4d2b-b00b-cf4e67a018e4", "is_inferred": false, "labels": [ "browser extension malware", "chrome extensions", "cryptocurrency theft", "firefox extensions", "j7tracker", "vreo" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "domain-name--6a4f3bd2-eaab-5efe-87b2-1707d6bc6efc", "type": "DomainName" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.663Z", "created_at": "2026-09-26T04:25:42.167Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-26T04:25:42.381Z", "updated_at": "2026-09-26T04:25:42.381Z" }, "description_available": false, "entity_type": "Malware", "id": "e894ee65-7333-4744-acbb-643b248a44fc", "is_inferred": false, "labels": [], "lang": "en", "name": "J7Tracker", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "malware--8be78dc6-45f2-5064-a235-3399a4866690", "type": "Malware" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.737Z", "created_at": "2026-09-26T04:25:52.731Z", "modified": "2026-09-26T04:26:08.423Z", "updated_at": "2026-09-26T04:26:08.423Z" }, "description_available": false, "entity_type": "Indicator", "id": "f2d16d56-4242-4c26-8826-e93c43fdaecd", "is_inferred": false, "labels": [ "browser extension malware", "chrome extensions", "cryptocurrency theft", "firefox extensions", "j7tracker", "vreo" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "indicator--496d7bbd-6d9c-500a-88ff-94494179b36c", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.725Z", "created_at": "2026-09-26T04:25:50.285Z", "modified": "2026-09-26T04:25:57.873Z", "updated_at": "2026-09-26T04:25:57.873Z" }, "description_available": false, "entity_type": "Indicator", "id": "f3dae071-2271-4b8f-ba8c-d36764805101", "is_inferred": false, "labels": [ "browser extension malware", "chrome extensions", "cryptocurrency theft", "firefox extensions", "j7tracker", "vreo" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "indicator--cfb8a608-8904-5ddb-99a6-d72140290f9a", "type": "Indicator" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.776Z", "created_at": "2026-09-26T04:27:57.329Z", "modified": "2026-09-26T04:27:57.613Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:57.613Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f2d16d56-4242-4c26-8826-e93c43fdaecd", "from_id": "f2d16d56-4242-4c26-8826-e93c43fdaecd", "from_name": null, "from_type": "Indicator", "id": "0da35263-dbb9-42c8-89c1-7d3a2a4d0dc6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--286a6c33-59fa-5761-ad6b-ab0970e1a394", "toId": "0cfd4994-a0bd-45c8-b5a4-2c8368ae80a2", "to_id": "0cfd4994-a0bd-45c8-b5a4-2c8368ae80a2", "to_name": "VREO", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.717Z", "created_at": "2026-09-26T04:25:58.751Z", "modified": "2026-09-26T04:25:59.145Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:25:59.145Z" }, "description_available": false, "entity_type": "targets", "fromId": "7fa22b5f-914c-422a-9d1c-da4a9dff9711", "from_id": "7fa22b5f-914c-422a-9d1c-da4a9dff9711", "from_name": "Orbit Tracker", "from_type": "Malware", "id": "1495690f-5644-4923-9c82-a5d9d55081ee", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--0e25c387-e2f6-5de2-bb3d-92aae12e2a84", "toId": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_name": "Finance", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.768Z", "created_at": "2026-09-26T04:27:49.268Z", "modified": "2026-09-26T04:27:49.686Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:49.686Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9547ebec-20a1-4430-89e6-1b4317d03373", "from_id": "9547ebec-20a1-4430-89e6-1b4317d03373", "from_name": null, "from_type": "Indicator", "id": "2ba12d59-240d-4e36-99ce-940ed9973661", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--df7bbbd6-fef8-55bb-ad18-8feaf0ac94e0", "toId": "7fa22b5f-914c-422a-9d1c-da4a9dff9711", "to_id": "7fa22b5f-914c-422a-9d1c-da4a9dff9711", "to_name": "Orbit Tracker", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.749Z", "created_at": "2026-09-26T04:27:26.117Z", "modified": "2026-09-26T04:27:26.467Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:26.467Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f3dae071-2271-4b8f-ba8c-d36764805101", "from_id": "f3dae071-2271-4b8f-ba8c-d36764805101", "from_name": null, "from_type": "Indicator", "id": "31224f04-da74-4c88-a140-719810d531b3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--d11b0750-e09a-5cfc-a1c1-4f2a2dbdd0d5", "toId": "0cfd4994-a0bd-45c8-b5a4-2c8368ae80a2", "to_id": "0cfd4994-a0bd-45c8-b5a4-2c8368ae80a2", "to_name": "VREO", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.750Z", "created_at": "2026-09-26T04:27:40.982Z", "modified": "2026-09-26T04:27:41.304Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:41.304Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f3dae071-2271-4b8f-ba8c-d36764805101", "from_id": "f3dae071-2271-4b8f-ba8c-d36764805101", "from_name": null, "from_type": "Indicator", "id": "327afe5f-92c4-4f08-9a46-1ea7019deafd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--5350c290-816a-58a7-bff8-ccbd813fa357", "toId": "33f33982-9158-49ba-bb1f-02e4d7d4fd9a", "to_id": "33f33982-9158-49ba-bb1f-02e4d7d4fd9a", "to_name": "GhostApe", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.741Z", "created_at": "2026-09-26T04:27:14.376Z", "modified": "2026-09-26T04:27:15.016Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:15.016Z" }, "description_available": false, "entity_type": "indicates", "fromId": "13f2a4dc-4bc9-45fc-b456-f85ba7213619", "from_id": "13f2a4dc-4bc9-45fc-b456-f85ba7213619", "from_name": null, "from_type": "Indicator", "id": "356c551e-7ea2-4930-b7ca-ffe5ce8b7f6a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--d5df44ac-d8ae-5262-a910-aed44ddbed7c", "toId": "33f33982-9158-49ba-bb1f-02e4d7d4fd9a", "to_id": "33f33982-9158-49ba-bb1f-02e4d7d4fd9a", "to_name": "GhostApe", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.715Z", "created_at": "2026-09-26T04:25:53.176Z", "modified": "2026-09-26T04:25:56.067Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:25:56.067Z" }, "description_available": false, "entity_type": "targets", "fromId": "e894ee65-7333-4744-acbb-643b248a44fc", "from_id": "e894ee65-7333-4744-acbb-643b248a44fc", "from_name": "J7Tracker", "from_type": "Malware", "id": "35cb4029-2920-42a4-9554-396bd017cb1c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--0e6cfc73-ee40-5885-99ab-1f39d2d44ce2", "toId": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_name": "Finance", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.757Z", "created_at": "2026-09-26T04:27:40.538Z", "modified": "2026-09-26T04:27:41.002Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:41.002Z" }, "description_available": false, "entity_type": "indicates", "fromId": "875d7522-3298-4680-8e48-4f7a589fff5b", "from_id": "875d7522-3298-4680-8e48-4f7a589fff5b", "from_name": null, "from_type": "Indicator", "id": "36d6053d-4002-4341-b9c3-6f4ae244f9f6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--57959c96-d5ea-5cdc-8792-6f8c0dc3da88", "toId": "0cfd4994-a0bd-45c8-b5a4-2c8368ae80a2", "to_id": "0cfd4994-a0bd-45c8-b5a4-2c8368ae80a2", "to_name": "VREO", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.740Z", "created_at": "2026-09-26T04:27:15.320Z", "modified": "2026-09-26T04:27:15.722Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:15.722Z" }, "description_available": false, "entity_type": "indicates", "fromId": "13f2a4dc-4bc9-45fc-b456-f85ba7213619", "from_id": "13f2a4dc-4bc9-45fc-b456-f85ba7213619", "from_name": null, "from_type": "Indicator", "id": "38b0d2c7-0016-465c-9ba2-aa1fbae94d11", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--2a488d51-e0f2-54ec-8235-5a7f81bde801", "toId": "0cfd4994-a0bd-45c8-b5a4-2c8368ae80a2", "to_id": "0cfd4994-a0bd-45c8-b5a4-2c8368ae80a2", "to_name": "VREO", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.738Z", "created_at": "2026-09-26T04:27:12.774Z", "modified": "2026-09-26T04:27:13.563Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:13.563Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f2d16d56-4242-4c26-8826-e93c43fdaecd", "from_id": "f2d16d56-4242-4c26-8826-e93c43fdaecd", "from_name": null, "from_type": "Indicator", "id": "3cb6571b-1020-47b5-9b14-55975d342f21", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--7ccbb828-7f32-5dd2-811b-66441d4dbefe", "toId": "0f457142-e38b-47d7-92db-d4e80e31e93a", "to_id": "0f457142-e38b-47d7-92db-d4e80e31e93a", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.718Z", "created_at": "2026-09-26T04:25:57.416Z", "modified": "2026-09-26T04:25:58.064Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:25:58.064Z" }, "description_available": false, "entity_type": "targets", "fromId": "33f33982-9158-49ba-bb1f-02e4d7d4fd9a", "from_id": "33f33982-9158-49ba-bb1f-02e4d7d4fd9a", "from_name": "GhostApe", "from_type": "Malware", "id": "40a94e07-44be-4ee9-8715-1867f458d398", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--31225eab-8b98-5387-b1b1-b0100906cc23", "toId": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_name": "Finance", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.749Z", "created_at": "2026-09-26T04:27:27.780Z", "modified": "2026-09-26T04:27:28.338Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:28.338Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f3dae071-2271-4b8f-ba8c-d36764805101", "from_id": "f3dae071-2271-4b8f-ba8c-d36764805101", "from_name": null, "from_type": "Indicator", "id": "60237c17-7720-42df-ba75-d3fc4c4c65d9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--b7b8a05d-42a9-5c94-bd55-c4d959c0b8d3", "toId": "7fa22b5f-914c-422a-9d1c-da4a9dff9711", "to_id": "7fa22b5f-914c-422a-9d1c-da4a9dff9711", "to_name": "Orbit Tracker", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.748Z", "created_at": "2026-09-26T04:27:25.111Z", "modified": "2026-09-26T04:27:25.418Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:25.418Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f3dae071-2271-4b8f-ba8c-d36764805101", "from_id": "f3dae071-2271-4b8f-ba8c-d36764805101", "from_name": null, "from_type": "Indicator", "id": "62957b22-051a-4d77-8fa9-387c816456ce", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--f2dbf15c-c921-52a8-b061-3746975c2ba5", "toId": "e894ee65-7333-4744-acbb-643b248a44fc", "to_id": "e894ee65-7333-4744-acbb-643b248a44fc", "to_name": "J7Tracker", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.775Z", "created_at": "2026-09-26T04:27:55.210Z", "modified": "2026-09-26T04:27:57.055Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:57.055Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f2d16d56-4242-4c26-8826-e93c43fdaecd", "from_id": "f2d16d56-4242-4c26-8826-e93c43fdaecd", "from_name": null, "from_type": "Indicator", "id": "674fa44f-243a-4ff8-8927-e856b3c6af73", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--3b722991-a350-50a0-b148-d54661d336de", "toId": "e894ee65-7333-4744-acbb-643b248a44fc", "to_id": "e894ee65-7333-4744-acbb-643b248a44fc", "to_name": "J7Tracker", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.756Z", "created_at": "2026-09-26T04:27:39.268Z", "modified": "2026-09-26T04:27:39.533Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:39.533Z" }, "description_available": false, "entity_type": "indicates", "fromId": "875d7522-3298-4680-8e48-4f7a589fff5b", "from_id": "875d7522-3298-4680-8e48-4f7a589fff5b", "from_name": null, "from_type": "Indicator", "id": "6cff6d07-aabd-4788-bda7-49bf123b5268", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--bc1a8fd6-3b01-5b7b-8ac6-1fd4d367bc99", "toId": "e894ee65-7333-4744-acbb-643b248a44fc", "to_id": "e894ee65-7333-4744-acbb-643b248a44fc", "to_name": "J7Tracker", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.716Z", "created_at": "2026-09-26T04:26:00.452Z", "modified": "2026-09-26T04:26:00.867Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:26:00.867Z" }, "description_available": false, "entity_type": "targets", "fromId": "0cfd4994-a0bd-45c8-b5a4-2c8368ae80a2", "from_id": "0cfd4994-a0bd-45c8-b5a4-2c8368ae80a2", "from_name": "VREO", "from_type": "Malware", "id": "7178e264-9fa8-4dc3-ab58-5c93cec738fb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--4f0a6b79-9ae4-5378-8348-42588acee330", "toId": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_name": "Finance", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.740Z", "created_at": "2026-09-26T04:27:18.674Z", "modified": "2026-09-26T04:27:18.822Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:18.822Z" }, "description_available": false, "entity_type": "indicates", "fromId": "13f2a4dc-4bc9-45fc-b456-f85ba7213619", "from_id": "13f2a4dc-4bc9-45fc-b456-f85ba7213619", "from_name": null, "from_type": "Indicator", "id": "7b586e08-14a2-4ed8-be0d-dacbf5c12f0e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--733a9e47-780c-592a-bb34-bcde942fa425", "toId": "7fa22b5f-914c-422a-9d1c-da4a9dff9711", "to_id": "7fa22b5f-914c-422a-9d1c-da4a9dff9711", "to_name": "Orbit Tracker", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.723Z", "created_at": "2026-09-26T04:27:08.437Z", "modified": "2026-09-26T04:27:09.391Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:09.391Z" }, "description_available": false, "entity_type": "based-on", "fromId": "13f2a4dc-4bc9-45fc-b456-f85ba7213619", "from_id": "13f2a4dc-4bc9-45fc-b456-f85ba7213619", "from_name": null, "from_type": "Indicator", "id": "83abb257-2812-4205-ad77-354d9673354f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--2b30a18e-c989-5cac-9b42-0672c4df0fb2", "toId": "e71b6aa1-a254-4d2b-b00b-cf4e67a018e4", "to_id": "e71b6aa1-a254-4d2b-b00b-cf4e67a018e4", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.767Z", "created_at": "2026-09-26T04:27:47.598Z", "modified": "2026-09-26T04:27:47.946Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:47.946Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9547ebec-20a1-4430-89e6-1b4317d03373", "from_id": "9547ebec-20a1-4430-89e6-1b4317d03373", "from_name": null, "from_type": "Indicator", "id": "875d1acb-195c-4ec7-97c6-492060697262", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--00bb9318-072a-50d2-90c1-524c1e49cc97", "toId": "e894ee65-7333-4744-acbb-643b248a44fc", "to_id": "e894ee65-7333-4744-acbb-643b248a44fc", "to_name": "J7Tracker", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.728Z", "created_at": "2026-09-26T04:27:11.019Z", "modified": "2026-09-26T04:27:11.197Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:11.197Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f3dae071-2271-4b8f-ba8c-d36764805101", "from_id": "f3dae071-2271-4b8f-ba8c-d36764805101", "from_name": null, "from_type": "Indicator", "id": "a2777c36-31bd-4c53-8ac2-4e9ca71be0a7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--3de5615a-033c-55dd-a0ff-6e9d6028af50", "toId": "d7d80d7b-d254-487f-9ccd-6f26d2652e54", "to_id": "d7d80d7b-d254-487f-9ccd-6f26d2652e54", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.769Z", "created_at": "2026-09-26T04:27:50.111Z", "modified": "2026-09-26T04:27:50.296Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:50.296Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9547ebec-20a1-4430-89e6-1b4317d03373", "from_id": "9547ebec-20a1-4430-89e6-1b4317d03373", "from_name": null, "from_type": "Indicator", "id": "a591a555-e809-42d1-84ea-8bb00374555c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--4d6b1fd5-c46d-5033-a258-d1be15f56741", "toId": "33f33982-9158-49ba-bb1f-02e4d7d4fd9a", "to_id": "33f33982-9158-49ba-bb1f-02e4d7d4fd9a", "to_name": "GhostApe", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.758Z", "created_at": "2026-09-26T04:27:47.584Z", "modified": "2026-09-26T04:27:47.904Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:47.904Z" }, "description_available": false, "entity_type": "indicates", "fromId": "875d7522-3298-4680-8e48-4f7a589fff5b", "from_id": "875d7522-3298-4680-8e48-4f7a589fff5b", "from_name": null, "from_type": "Indicator", "id": "baeeda80-3c57-48fa-8dae-999f9376d848", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--53a0f3db-350f-5196-8e46-18df6f4ad44b", "toId": "7fa22b5f-914c-422a-9d1c-da4a9dff9711", "to_id": "7fa22b5f-914c-422a-9d1c-da4a9dff9711", "to_name": "Orbit Tracker", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.776Z", "created_at": "2026-09-26T04:28:00.452Z", "modified": "2026-09-26T04:28:00.631Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:28:00.631Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f2d16d56-4242-4c26-8826-e93c43fdaecd", "from_id": "f2d16d56-4242-4c26-8826-e93c43fdaecd", "from_name": null, "from_type": "Indicator", "id": "c2e39457-70d9-44d6-8fe2-3bdc44058658", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--fa6562f3-c9d5-54a4-b765-f740ba2ac232", "toId": "7fa22b5f-914c-422a-9d1c-da4a9dff9711", "to_id": "7fa22b5f-914c-422a-9d1c-da4a9dff9711", "to_name": "Orbit Tracker", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.739Z", "created_at": "2026-09-26T04:27:13.621Z", "modified": "2026-09-26T04:27:14.065Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:14.065Z" }, "description_available": false, "entity_type": "indicates", "fromId": "13f2a4dc-4bc9-45fc-b456-f85ba7213619", "from_id": "13f2a4dc-4bc9-45fc-b456-f85ba7213619", "from_name": null, "from_type": "Indicator", "id": "cb367237-7ac2-4027-adeb-758226a0a073", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--32853369-fea5-5536-b6a4-135e602e5c80", "toId": "e894ee65-7333-4744-acbb-643b248a44fc", "to_id": "e894ee65-7333-4744-acbb-643b248a44fc", "to_name": "J7Tracker", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.732Z", "created_at": "2026-09-26T04:27:11.690Z", "modified": "2026-09-26T04:27:12.246Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:12.246Z" }, "description_available": false, "entity_type": "based-on", "fromId": "875d7522-3298-4680-8e48-4f7a589fff5b", "from_id": "875d7522-3298-4680-8e48-4f7a589fff5b", "from_name": null, "from_type": "Indicator", "id": "d502732d-654c-45fe-b38e-4211c709dfba", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--1f108dba-7657-55fa-b352-0a14e111519b", "toId": "95d1a98d-7e8a-48da-b091-ba94da66fcd3", "to_id": "95d1a98d-7e8a-48da-b091-ba94da66fcd3", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.768Z", "created_at": "2026-09-26T04:27:52.841Z", "modified": "2026-09-26T04:27:53.087Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:53.087Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9547ebec-20a1-4430-89e6-1b4317d03373", "from_id": "9547ebec-20a1-4430-89e6-1b4317d03373", "from_name": null, "from_type": "Indicator", "id": "dba5b1ee-a157-4229-a4e7-73fb20174854", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--8e480c3f-d090-591b-8969-16b4f1115a54", "toId": "0cfd4994-a0bd-45c8-b5a4-2c8368ae80a2", "to_id": "0cfd4994-a0bd-45c8-b5a4-2c8368ae80a2", "to_name": "VREO", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.758Z", "created_at": "2026-09-26T04:27:41.393Z", "modified": "2026-09-26T04:27:41.841Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:41.841Z" }, "description_available": false, "entity_type": "indicates", "fromId": "875d7522-3298-4680-8e48-4f7a589fff5b", "from_id": "875d7522-3298-4680-8e48-4f7a589fff5b", "from_name": null, "from_type": "Indicator", "id": "e818bae1-fe4f-4e43-8e5f-669b0d9d5e7e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--ac1ed8d0-f393-5d59-a6c4-04d43fa2621a", "toId": "33f33982-9158-49ba-bb1f-02e4d7d4fd9a", "to_id": "33f33982-9158-49ba-bb1f-02e4d7d4fd9a", "to_name": "GhostApe", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.736Z", "created_at": "2026-09-26T04:27:12.324Z", "modified": "2026-09-26T04:27:12.818Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:12.818Z" }, "description_available": false, "entity_type": "based-on", "fromId": "9547ebec-20a1-4430-89e6-1b4317d03373", "from_id": "9547ebec-20a1-4430-89e6-1b4317d03373", "from_name": null, "from_type": "Indicator", "id": "f1065556-7650-4c80-b2ee-1443361cdaa4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--8964fc62-af14-56e8-b2de-a49144d2ca3c", "toId": "6a9b9772-9fd5-4e09-bece-2ba52323f3e9", "to_id": "6a9b9772-9fd5-4e09-bece-2ba52323f3e9", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:55.777Z", "created_at": "2026-09-26T04:27:58.034Z", "modified": "2026-09-26T04:27:58.231Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T04:27:58.231Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f2d16d56-4242-4c26-8826-e93c43fdaecd", "from_id": "f2d16d56-4242-4c26-8826-e93c43fdaecd", "from_name": null, "from_type": "Indicator", "id": "f73a3ca8-6128-4cdb-a2c4-c02aac4a4461", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "standard_id": "relationship--7d7b3b7f-1045-5f41-8013-9c4d4f7a9696", "toId": "33f33982-9158-49ba-bb1f-02e4d7d4fd9a", "to_id": "33f33982-9158-49ba-bb1f-02e4d7d4fd9a", "to_name": "GhostApe", "to_type": "Malware" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "j7tracker[.]io", "description_available": false, "object_id": "13f2a4dc-4bc9-45fc-b456-f85ba7213619", "object_ids": [ "13f2a4dc-4bc9-45fc-b456-f85ba7213619", "e71b6aa1-a254-4d2b-b00b-cf4e67a018e4" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "13f2a4dc-4bc9-45fc-b456-f85ba7213619", "valid_from": "2026-09-10T02:31:35.000Z", "valid_until": "2026-12-21T17:26:43.260Z", "validity_status": "active", "value": "j7tracker.io" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "e71b6aa1-a254-4d2b-b00b-cf4e67a018e4", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "j7tracker.io" } ], "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "type": "domain", "valid_from": "2026-09-10T02:31:35.000Z", "valid_until": "2026-12-21T17:26:43.260Z", "validity_status": "active", "value": "j7tracker.io" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "snapshot[.]xyz", "description_available": false, "object_id": "9547ebec-20a1-4430-89e6-1b4317d03373", "object_ids": [ "6a9b9772-9fd5-4e09-bece-2ba52323f3e9", "9547ebec-20a1-4430-89e6-1b4317d03373" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "9547ebec-20a1-4430-89e6-1b4317d03373", "valid_from": "2026-09-10T02:31:35.000Z", "valid_until": "2026-12-21T17:26:43.260Z", "validity_status": "active", "value": "snapshot.xyz" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "6a9b9772-9fd5-4e09-bece-2ba52323f3e9", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "snapshot.xyz" } ], "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "type": "domain", "valid_from": "2026-09-10T02:31:35.000Z", "valid_until": "2026-12-21T17:26:43.260Z", "validity_status": "active", "value": "snapshot.xyz" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "5b4fbe0658ff76f042c3cc2dfe3d1a3eda963e435a24dfc868cb583bde8c7b91", "description_available": false, "object_id": "f3dae071-2271-4b8f-ba8c-d36764805101", "object_ids": [ "d7d80d7b-d254-487f-9ccd-6f26d2652e54", "f3dae071-2271-4b8f-ba8c-d36764805101" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "f3dae071-2271-4b8f-ba8c-d36764805101", "valid_from": "2026-09-10T02:31:35.000Z", "valid_until": "2027-06-27T13:41:19.557Z", "validity_status": "active", "value": "5b4fbe0658ff76f042c3cc2dfe3d1a3eda963e435a24dfc868cb583bde8c7b91" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "d7d80d7b-d254-487f-9ccd-6f26d2652e54", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "5b4fbe0658ff76f042c3cc2dfe3d1a3eda963e435a24dfc868cb583bde8c7b91" } ], "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft", "type": "sha256", "valid_from": "2026-09-10T02:31:35.000Z", "valid_until": "2027-06-27T13:41:19.557Z", "validity_status": "active", "value": "5b4fbe0658ff76f042c3cc2dfe3d1a3eda963e435a24dfc868cb583bde8c7b91" } ], "mentioned": [ { "confidence": 50, "evidence_id": "33f33982-9158-49ba-bb1f-02e4d7d4fd9a", "name": "GhostApe", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "e894ee65-7333-4744-acbb-643b248a44fc", "name": "J7Tracker", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "7fa22b5f-914c-422a-9d1c-da4a9dff9711", "name": "Orbit Tracker", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "0cfd4994-a0bd-45c8-b5a4-2c8368ae80a2", "name": "VREO", "role": "mentionné", "type": "Malware" } ], "mitre": { "associated_repertoire": [], "direct_techniques": [] }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-10T02:31:34.738Z", "created_at": "2026-09-26T04:28:03.747Z", "modified": "2026-09-26T04:28:03.969Z", "published": "2026-09-10T02:31:34.738Z", "updated_at": "2026-09-26T04:28:03.969Z" }, "description_available": true, "id": "5be944b4-73e1-43b5-8a8c-6a31e3a99286", "is_inferred": false, "labels": [ "browser extension malware", "chrome extensions", "cryptocurrency theft", "firefox extensions", "j7tracker", "vreo" ], "lang": "en", "name": "Malicious Chrome and Firefox Extensions Steal Crypto Traders' Session and Wallet Data", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-10T02:31:34.738Z", "references": [ { "external_id": null, "id": "dfab15bc-15b3-4337-953f-0e82d74bf8cb", "source_name": "alien-vault", "url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft" }, { "external_id": "6aa21686ffabe101cf6b37c5", "id": "83da20c4-b8e3-453a-85cf-e66fd699cf41", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6aa21686ffabe101cf6b37c5" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft" }, "targets": [ { "confidence": 50, "evidence_id": "7178e264-9fa8-4dc3-ab58-5c93cec738fb", "name": "Finance", "role": "cible déclarée (relation targets)", "type": "Sector" } ], "techniques": [], "vulnerabilities": [] }, "report_id": "5be944b4-73e1-43b5-8a8c-6a31e3a99286", "schema_version": 1, "selected_date": "2026-09-10", "source_url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft" }