---
id: 6291
title: "Decoy Manuals and Malicious Browser Extensions: A Closer Look at a Multi-Layered Threat"
source_domain: hunt.io
source_url: "https://hunt.io/blog/decoy-docs-and-malicious-browser-extensions-a-closer-look-at-a-multi-layered-threat"
published_at: "2024-09-10T00:00:00Z"
tags: ["malware", "browser-extension", "spyware", "cobalt-strike", "open-directories", "scheduled-tasks"]
phying_url: "https://phying.com/item/6291"
lang: en
---

# Decoy Manuals and Malicious Browser Extensions: A Closer Look at a Multi-Layered Threat

## Summary

Hunt.io exposes a multi-stage campaign: a scheduled-task executable and 'Dark Mode' Chrome extensions built from open-source spying code, plus a decoy Cobalt Strike PDF pushing duplicates.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2024-09-10T00:00:00Z
- **Original:** https://hunt.io/blog/decoy-docs-and-malicious-browser-extensions-a-closer-look-at-a-multi-layered-threat
- **Phying News:** https://phying.com/item/6291