I discovered some obfuscated code in the PDF Toolbox extension which is used by more than 2 million people. The code is meant to download a “config” file from serasearchtop[.]com after which it will run some functions according to this configuration. I didn’t see a non-empty configuration yet. However, given the specific call pattern used, I’m mostly certain that the idea here is injecting arbitrary JavaScript code into every website when it loads.
I suspect that this is part of the extension’s monetization strategy, most likely goal being injecting ads into all websites. But it could really be anything, and it might be spying on people as they enter their online banking credentials or credit card numbers.
palant.info/2023/05/16/malicio…
Malicious code in PDF Toolbox extension
PDF Toolbox extension (used by more than 2 million users) contains obfuscated malicious code, allowing serasearchtop[.]com website to inject arbitrary JavaScript code into all websites you visit.Almost Secure
![STOP DOING OFFICES
* WORK WAS NOT SUPPOSED TO TAKE 90 MINUTES BY CAR TO GET TO
* YEARS OF URBANIZATION yet NO REAL-WORLD USE FOUND for going to a different building to use the SAME INTERNET
* Wanted to do that anyway for a laugh? We had a tool for that, it was called COFFEE SHOPS
* “Can you wrap up your call, we have this room booked” “how do we get office parking reimbursed” - Statements dreamt up by the utterly Deranged
LOOK at what corporations have been demanding your Respect for all this time with all the labor we have given them
(These are REAL FURNISHINGS found in REAL OFFICES)
[fluorescent strip lighting]
?????
[crowded open plan desks]
???????
[grey carpeted corridor]
?????????????
“Hello | would like to hear [headset] half of your Zoom call”
They have played us for absolute fools](https://fedi.ml/photo/preview/640/436962 "STOP DOING OFFICES
* WORK WAS NOT SUPPOSED TO TAKE 90 MINUTES BY CAR TO GET TO
* YEARS OF URBANIZATION yet NO REAL-WORLD USE FOUND for going to a different building to use the SAME INTERNET
* Wanted to do that anyway for a laugh? We had a tool for that, it was called COFFEE SHOPS
* “Can you wrap up your call, we have this room booked” “how do we get office parking reimbursed” - Statements dreamt up by the utterly Deranged
LOOK at what corporations have been demanding your Respect for all this time with all the labor we have given them
(These are REAL FURNISHINGS found in REAL OFFICES)
[fluorescent strip lighting]
?????
[crowded open plan desks]
???????
[grey carpeted corridor]
?????????????
“Hello | would like to hear [headset] half of your Zoom call”
They have played us for absolute fools")
Talon
in reply to Dan Gero • • •Dan Gero
in reply to Talon • • •Andre Louis
in reply to Dan Gero • • •Talon
in reply to Dan Gero • • •Dan Gero
in reply to Talon • • •reshared this
Andre Louis and victor tsaran reshared this.
Andre Louis
in reply to Dan Gero • • •Dan Gero
in reply to Andre Louis • • •Talon
in reply to Andre Louis • • •Andre Louis
in reply to Talon • • •Andre Louis
in reply to Dan Gero • • •Dan Gero
in reply to Andre Louis • • •