Fake PDF Installs Chrome Extension That Steals Sessions

There's a phishing campaign making the rounds that takes the oldest lure in the book, a fake invoice attachment, and uses it as the door into something quite a bit more sophisticated.

The file is called Fattura-2819889242.pfd.js. It is dressed up to look like a PDF, but it is obfuscated JavaScript. Open it, and you kick off a chain that ends with a malicious Chrome extension running the show from inside your browser.

Installed as if IT did it

The neat trick is how the extension gets in. A PowerShell script edits Chrome's policy settings so the add-on registers as an administrator-managed deployment. That is the same mechanism a corporate IT team uses to push approved extensions out across a fleet. No suspicious install prompt. Nothing obviously off in the extensions list. To anyone glancing at the browser, it looks like something the company put there on purpose.

Once it's in, the extension starts collecting the things attackers actually care about: cookies, open tabs, URLs, language settings, and enough browser fingerprinting data to impersonate the user convincingly.

Session cookies are the prize

Authenticated session cookies are what make this campaign worth running. With a valid cookie, an attacker doesn't need the password and doesn't need the second factor. They drop the cookie into their own browser and the service treats the request as the user, back from lunch. Multi-factor authentication isn't bypassed so much as side-stepped, because the login already happened.

That is the part defenders keep underestimating. MFA protects the moment of sign-in. It does not protect the session that follows.

Living inside legitimate features

What researchers at G DATA flagged as the most interesting piece of tradecraft is the use of Chrome Native Messaging. It's a legitimate feature that lets a browser extension talk to a separate program registered on the host machine. The extension itself never launches PowerShell or touches the file system directly. It sends a message to its native companion, and the companion does the work, running commands, enumerating the contents of the C: drive, fetching whatever the operator asks for.

Everything is happening inside features Chrome and Windows were built to support. There is no exotic exploit. No zero-day. Just a chain of normal-looking behaviour that, end to end, hands an attacker the keys.

The entry point is still a person

For all the cleverness further down the chain, the way in is the same as it has been for twenty years. An email arrives with an attachment from someone the recipient had no reason to trust. The double extension, .pfd.js, is the giveaway, but only if you know to look for it, and only if your operating system isn't hiding the second half.

Verifying the sender before opening anything continues to do more heavy lifting than most of the technology stacked behind it. Which is faintly depressing, and entirely the point.