Malware Newsletter Round 115: Twitch OAuth Token Theft via Malicious Browser Extensions and the Gitea N-Day Linux Rootkit Campaign — Detection and Response Guide

---
title: Browser Extension Force-Installed or Sideloaded via Registry Policy
id: 3f7a91c2-8e54-4b61-9d03-2c6a5e8f1a47
status: experimental
description: Detects browser extensions being installed or force-installed via Windows registry policy keys, a common persistence and distribution mechanism for malicious extensions that harvest session tokens.
references:
  - https://attack.mitre.org/techniques/T1176/
  - https://securityaffairs.com/199409/malware/security-affairs-malware-newsletter-round-115.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1176
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - '\Policies\Google\Chrome\ExtensionInstallForcelist'
      - '\Policies\Microsoft\Edge\ExtensionInstallForcelist'
      - '\Software\Google\Chrome\Extensions'
      - '\Software\Microsoft\Edge\Extensions'
  filter_known_updaters:
    Image|endswith:
      - '\GoogleUpdate.exe'
      - '\MicrosoftEdgeUpdate.exe'
  condition: selection and not filter_known_updaters
falsepositives:
  - Enterprise extension deployments via GPO or MDM (baseline approved extension IDs)
level: medium
---
title: Linux Kernel Module Load by Non-Package-Manager Process
id: 8c2d5e19-4a73-4f08-b651-9d3e7c2a6b58
status: experimental
description: Detects loading of kernel modules via insmod or modprobe from non-standard paths or by non-package-management parents, consistent with LKM rootkit installation observed in the Gitea compromise campaign.
references:
  - https://attack.mitre.org/techniques/T1547/006/
  - https://attack.mitre.org/techniques/T1014/
  - https://securityaffairs.com/199409/malware/security-affairs-malware-newsletter-round-115.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.defense_evasion
  - attack.t1547.006
  - attack.t1014
logsource:
  category: process_creation
  product: linux
detection:
  selection_tool:
    Image|endswith:
      - '/insmod'
      - '/modprobe'
  selection_suspicious_args:
    CommandLine|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
      - '/home/'
  filter_legit:
    ParentImage|endswith:
      - '/dpkg'
      - '/apt'
      - '/yum'
      - '/dnf'
      - '/systemd'
  condition: selection_tool and (selection_suspicious_args or not filter_legit)
falsepositives:
  - Legitimate driver installation by administrators; tune the parent-process filter to your fleet's configuration management tooling
level: high
---
title: Gitea or Git Service Process Spawning Shell or Downloader
id: 5b1e8d42-7c36-4a92-8f14-3d9a2e7c5b06
status: experimental
description: Detects the Gitea server process spawning shells, interpreters, or download utilities, a strong post-exploitation indicator following n-day exploitation of the web application.
references:
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059/
  - https://securityaffairs.com/199409/malware/security-affairs-malware-newsletter-round-115.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1190
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/gitea'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Gitea hooks and CI integrations that legitimately invoke shells; baseline hook scripts per repository and alert on deviations
level: high

let suspiciousParents = dynamic(["gitea", "gitlab", "nginx", "apache", "httpd"]);
let suspiciousChildren = dynamic(["bash", "sh", "dash", "curl", "wget", "insmod", "modprobe", "python", "perl"]);
union isfuzzy=true
  (Syslog
  | where Facility =~ "auth" or Facility =~ "kern" or SyslogMessage has_any ("insmod", "modprobe")
  | where SyslogMessage has_any (suspiciousChildren)
  | extend ParsedCmd = SyslogMessage
  | project TimeGenerated, Computer, HostIP, ParsedCmd, SeverityLevel),
  (DeviceProcessEvents
  | where InitiatingProcessFileName has_any (suspiciousParents)
  | where FileName has_any (suspiciousChildren)
  | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName)
| sort by TimeGenerated desc

DeviceNetworkEvents
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe")
| where RemoteUrl has_any ("api.telegram.org", "t.me") or RemoteUrl endswith ".onion.site"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, RemoteUrl, RemoteIP
| sort by ConnectionCount desc

-- Hunt for processes running deleted executables and modules loaded from suspicious paths
SELECT Pid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime
FROM pslist()
WHERE Exe =~ '(deleted)'
   OR Exe =~ '/tmp/|/dev/shm/|/var/tmp/'
   OR CommandLine =~ 'insmod|modprobe'

-- Enumerate Chromium extension manifests across all user profiles
SELECT FullPath,
       Data.name AS ExtensionName,
       Data.version AS ExtensionVersion,
       Data.permissions AS Permissions,
       Mtime AS LastModified
FROM glob(globs='C:/Users/*/AppData/Local/*/User Data/Default/Extensions/*/*/manifest.json')
WHERE Permissions =~ 'cookies|webRequest|<all_urls>|tabs'

#!/bin/bash
# Rootkit and Gitea post-exploitation audit — run as root

echo "=== Recently loaded kernel modules (non-standard paths) ==="
lsmod | awk '{print $1}' | while read mod; do
  path=$(modinfo -n "$mod" 2>/dev/null)
  if [ -n "$path" ] && [[ "$path" != /lib/modules/* ]]; then
    echo "[!] $mod loaded from non-standard path: $path"
  fi
done

echo ""
echo "=== Module load events in audit logs (last 7 days) ==="
ausearch -ts recent -k modules 2>/dev/null || grep -E "insmod|modprobe" /var/log/auth.log /var/log/syslog 2>/dev/null | tail -50

echo ""
echo "=== Gitea version check ==="
if command -v gitea &>/dev/null; then
  gitea --version
  echo "Compare against latest release: https://dl.gitea.com/gitea/ and https://github.com/go-gitea/gitea/security/advisories"
else
  sudo -u git /usr/local/bin/gitea --version 2>/dev/null || echo "Gitea binary not found in PATH — check your install location"
fi

echo ""
echo "=== Processes with deleted executables (possible rootkit activity) ==="
for pid in $(ls /proc | grep -E '^[0-9]+$'); do
  exe=$(readlink /proc/$pid/exe 2>/dev/null)
  if [[ "$exe" == *"(deleted)"* ]]; then
    echo "[!] PID $pid ($(cat /proc/$pid/comm 2>/dev/null)) running deleted binary: $exe"
  fi
done

echo ""
echo "=== Persistence check: systemd units and cron modified in last 14 days ==="
find /etc/systemd/system /etc/cron.d /var/spool/cron -type f -mtime -14 2>/dev/null

echo ""
echo "=== Gitea-spawned shell processes right now ==="
ps auxf | grep -A2 -i gitea | grep -E "bash|sh |curl|wget|python" || echo "None found"

# Browser extension audit — force-installed via policy and user-installed with risky permissions
$policyPaths = @(
    'HKLM:\\\SOFTWARE\\Policies\\Google\\Chrome\\ExtensionInstallForcelist',
    'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Edge\\ExtensionInstallForcelist',
    'HKCU:\\SOFTWARE\\Google\\Chrome\\Extensions',
    'HKCU:\\SOFTWARE\\Microsoft\\Edge\\Extensions'
)
foreach ($path in $policyPaths) {
    if (Test-Path $path) {
        Write-Host "[+] Entries under $path" -ForegroundColor Yellow
        Get-ChildItem $path -ErrorAction SilentlyContinue | ForEach-Object { $_.PSChildName }
        (Get-ItemProperty $path -ErrorAction SilentlyContinue).PSObject.Properties |
            Where-Object { $_.Name -notmatch '^PS' } | ForEach-Object { "$($_.Name) = $($_.Value)" }
    }
}

# Enumerate installed Chromium extensions and flag high-risk permission scopes
$extRoot = "$env:LOCALAPPDATA\\Google\\Chrome\\User Data\\Default\\Extensions"
$riskyPerms = 'cookies|webRequest|webRequestBlocking|<all_urls>|debugger|nativeMessaging'
if (Test-Path $extRoot) {
    Get-ChildItem $extRoot -Directory | ForEach-Object {
        $manifest = Get-ChildItem $_.FullName -Recurse -Filter 'manifest.json' -ErrorAction SilentlyContinue | Select-Object -First 1
        if ($manifest) {
            $json = Get-Content $manifest.FullName -Raw | ConvertFrom-Json -ErrorAction SilentlyContinue
            $perms = ($json.permissions + $json.host_permissions) -join ','
            if ($perms -match $riskyPerms) {
                Write-Host "[!] $($json.name) ($($_.Name)) — permissions: $perms" -ForegroundColor Red
            }
        }
    }
}