New malicious software has been discovered that is capable of operating through various web browser extensions. The malware called Razy disguises itself as a browser extension. In an attempt to deactivate security checks, it installs itself or infects existing browser extensions. The new malicious software is able to "attack" various browsers, such as Google Chrome, Mozilla Firefox, and Yandex.
Researchers at Kaspersky Lab have identified the virus as a new form of Trojan that steals digital currencies from infected devices. When a user opens their wallet using an infected browser, Razy overwrites the addresses in the wallet with others controlled by the hacker. After this, the user's attempt to transfer funds to one of "their" addresses may end in the loss of those funds.
Apparently, when the user logs into the wallet, the attackers also obtain the password they entered for the wallet. In addition, the Razy Trojan places malicious advertisements and videos in infected browsers, as well as posting fraudulent offers on Telegram. According to researchers at Kaspersky Lab, the Razy Trojan can be destroyed with the help of updated antivirus software with AI elements.
