Opera GX Silent Mod Installation Flaw: Detection and Remediation

---
title: Opera GX Suspicious Mod Installation via File Creation
id: 8f4e2d1a-9b3c-4f5e-8a2b-1c3d4e5f6a7b
status: experimental
description: Detects the creation of files in the Opera GX mods or extensions directory by the browser process, which may indicate a silent installation or modification.
references:
  - https://thehackernews.com/2026/07/opera-gx-flaw-let-malicious-sites-auto.html
author: Security Arsenal
date: 2026/07/08
tags:
  - attack.initial_access
  - attack.t1190
  - attack.persistence
  - attack.t1173
logsource:
  category: file_create
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - 'Roaming\Opera Software\Opera GX\mods'
      - 'Roaming\Opera Software\Opera GX\extensions'
    Image|endswith:
      - '\opera.exe'
      - '\launcher.exe'
  condition: selection
falsepositives:
  - Legitimate user installation of GX Mods or extensions
level: medium
---
title: Browser Process Spawning Shell (Suspicious Extension Behavior)
id: 9a5f3e2b-0c4d-4a5e-9b1c-2d3e4f5a6b7c
status: experimental
description: Detects the Opera browser spawning a shell or script interpreter, a common behavior for malicious extensions achieving execution beyond the browser sandbox.
references:
  - https://thehackernews.com/2026/07/opera-gx-flaw-let-malicious-sites-auto.html
author: Security Arsenal
date: 2026/07/08
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\opera.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
  condition: selection
falsepositives:
  - Legitimate user launching a link or protocol handler that invokes a shell
level: high

DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath has @'Roaming\Opera Software\Opera GX' 
| where FolderPath has_any ('mods', 'extensions')
| where ActionType == 'FileCreated'
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, FileName, FolderPath, SHA256
| summarize count() by DeviceName, InitiatingProcessFileName

-- Hunt for recently created Opera GX Mods
SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs='/*/Users/*/AppData/Roaming/Opera Software/Opera GX/mods/**')
WHERE Mtime > now() - 7d
ORDER BY Mtime DESC

# Audit Opera GX Mods and Verify Patch Level

$OperaPath = "$env:APPDATA\Opera Software\Opera GX"
$ModsPath = "$OperaPath\mods"
$ExtensionsPath = "$OperaGX\extensions"
$LogPath = "$env:TEMP\OperaGX_Audit.log"

Function Log-Write {
    param ([string]$logstring)
    Add-Content $LogPath -Value $logstring
    Write-Host $logstring
}

Log-Write "Starting Opera GX Security Audit - $(Get-Date)"

# 1. Check if Opera GX is installed
if (Test-Path $OperaPath) {
    Log-Write "Opera GX installation found at: $OperaPath"

    # 2. Audit Mods Directory for unverified files
    if (Test-Path $ModsPath) {
        Log-Write "[INFO] Scanning Mods directory..."
        $mods = Get-ChildItem -Path $ModsPath -Recurse -File | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }
        
        if ($mods) {
            Log-Write "[WARNING] Recently modified Mod files detected. Manual review required:"
            $mods | ForEach-Object { Log-Write "File: $($_.FullName) | Modified: $($_.LastWriteTime)" }
        } else {
            Log-Write "[OK] No recently modified Mod files found."
        }
    } else {
        Log-Write "[INFO] No Mods directory found."
    }

    # 3. Identify Version (Requires parsing 'ver.txt' or similar mechanism, usually in version folder or prefs)
    # Opera stores version info in the directory name or specific files. We check the directory structure.
    $versionDirs = Get-ChildItem -Path $OperaPath -Directory | Where-Object { $_.Name -match '^\d+\.\d+\.\d+\.\d+$' }
    if ($versionDirs) {
        Log-Write "[INFO] Detected Version Directory: $($versionDirs.Name)"
        # In a real script, compare this against a known patched version variable.
    }

} else {
    Log-Write "Opera GX not found on this endpoint."
}

Log-Write "Audit Complete. Log saved to $LogPath"