Skip to content

Commit 5840206

Browse files
github-actions[bot]github-actions[bot]
committed
chore: update feeds 2026-07-10
1 parent 92db523 commit 5840206

18 files changed

Lines changed: 22480 additions & 21804 deletions

‎browser_extensions_list.csv‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
11
browser_extension,browser_extension_id_wildcard,browser_extension_id,metadata_category,metadata_type,metadata_link,metadata_comment,crx_file_sha256
2+
"Video Downloader","*kghcdbkokgjghlfeojcpeoclfnljkbdk*","kghcdbkokgjghlfeojcpeoclfnljkbdk","malware","malicious","https://www.koi.ai/blog/a-month-of-malware-in-the-chrome-web-store","",""
3+
"Bass Booster","*ndhaplegimoabombidcdfogcnpmcicik*","ndhaplegimoabombidcdfogcnpmcicik","malware","malicious","https://www.koi.ai/blog/a-month-of-malware-in-the-chrome-web-store","",""
4+
"Downloader For Instagram","*ompafndkajgkoldjbgnbikogdkljinlb*","ompafndkajgkoldjbgnbikogdkljinlb","malware","malicious","https://www.koi.ai/blog/a-month-of-malware-in-the-chrome-web-store","",""
5+
"Downloader For Instagram","*bhfelhfpjghfmhogedjnlmdpkbhmjhlf*","bhfelhfpjghfmhogedjnlmdpkbhmjhlf","malware","malicious","https://www.koi.ai/blog/a-month-of-malware-in-the-chrome-web-store","",""
26
"Surfshark VPN","*jkhapebnlgocjncbbfccgiepjlghehmj*","jkhapebnlgocjncbbfccgiepjlghehmj","PROXY/VPN","Defense Evasion","https://microsoftedge.microsoft.com/addons/detail/jkhapebnlgocjncbbfccgiepjlghehmj","",""
37
"Private Internet Access – Proxy for Chrome","*jplnlifepflhkbkgonidnobkakhmpnmh*","jplnlifepflhkbkgonidnobkakhmpnmh","PROXY/VPN","Defense Evasion","https://chromewebstore.google.com/detail/private-internet-access-%E2%80%93/jplnlifepflhkbkgonidnobkakhmpnmh","",""
48
"AdGuard VPN: free & secure proxy","*hhdobjgopfphlmjbmnpglhfcgppchgje*","hhdobjgopfphlmjbmnpglhfcgppchgje","PROXY/VPN","Defense Evasion","https://chromewebstore.google.com/detail/adguard-vpn-free-secure-p/hhdobjgopfphlmjbmnpglhfcgppchgje","",""

‎feeds/elastic_detection_rule.ndjson‎

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

‎feeds/elastic_threat_intel.ndjson‎

Lines changed: 2045 additions & 2041 deletions
Large diffs are not rendered by default.

‎feeds/extsentry_feed.json‎

Lines changed: 47 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{
22
"feed_name": "ExtSentry - Browser Extension Threat Intelligence",
33
"feed_version": "1.0",
4-
"generated": "2026-07-10T12:56:46Z",
4+
"generated": "2026-07-10T15:30:47Z",
55
"source": "https://github.com/mthcht/awesome-lists",
66
"license": "TLP:CLEAR",
7-
"total_indicators": 2041,
7+
"total_indicators": 2045,
88
"categories": {
9+
"malware": 1822,
910
"PROXY/VPN": 17,
10-
"malware": 1818,
1111
"PUP": 5,
1212
"compromised": 92,
1313
"cryptocurrency": 90,
@@ -19,6 +19,50 @@
1919
"metadata_category": 1
2020
},
2121
"indicators": [
22+
{
23+
"extension_id": "kghcdbkokgjghlfeojcpeoclfnljkbdk",
24+
"extension_name": "Video Downloader",
25+
"wildcard_pattern": "*kghcdbkokgjghlfeojcpeoclfnljkbdk*",
26+
"category": "malware",
27+
"threat_type": "malicious",
28+
"reference_url": "https://www.koi.ai/blog/a-month-of-malware-in-the-chrome-web-store",
29+
"description": "",
30+
"crx_sha256": null,
31+
"chrome_webstore_url": "https://chromewebstore.google.com/detail/kghcdbkokgjghlfeojcpeoclfnljkbdk"
32+
},
33+
{
34+
"extension_id": "ndhaplegimoabombidcdfogcnpmcicik",
35+
"extension_name": "Bass Booster",
36+
"wildcard_pattern": "*ndhaplegimoabombidcdfogcnpmcicik*",
37+
"category": "malware",
38+
"threat_type": "malicious",
39+
"reference_url": "https://www.koi.ai/blog/a-month-of-malware-in-the-chrome-web-store",
40+
"description": "",
41+
"crx_sha256": null,
42+
"chrome_webstore_url": "https://chromewebstore.google.com/detail/ndhaplegimoabombidcdfogcnpmcicik"
43+
},
44+
{
45+
"extension_id": "ompafndkajgkoldjbgnbikogdkljinlb",
46+
"extension_name": "Downloader For Instagram",
47+
"wildcard_pattern": "*ompafndkajgkoldjbgnbikogdkljinlb*",
48+
"category": "malware",
49+
"threat_type": "malicious",
50+
"reference_url": "https://www.koi.ai/blog/a-month-of-malware-in-the-chrome-web-store",
51+
"description": "",
52+
"crx_sha256": null,
53+
"chrome_webstore_url": "https://chromewebstore.google.com/detail/ompafndkajgkoldjbgnbikogdkljinlb"
54+
},
55+
{
56+
"extension_id": "bhfelhfpjghfmhogedjnlmdpkbhmjhlf",
57+
"extension_name": "Downloader For Instagram",
58+
"wildcard_pattern": "*bhfelhfpjghfmhogedjnlmdpkbhmjhlf*",
59+
"category": "malware",
60+
"threat_type": "malicious",
61+
"reference_url": "https://www.koi.ai/blog/a-month-of-malware-in-the-chrome-web-store",
62+
"description": "",
63+
"crx_sha256": null,
64+
"chrome_webstore_url": "https://chromewebstore.google.com/detail/bhfelhfpjghfmhogedjnlmdpkbhmjhlf"
65+
},
2266
{
2367
"extension_id": "jkhapebnlgocjncbbfccgiepjlghehmj",
2468
"extension_name": "Surfshark VPN",

‎feeds/extsentry_ioc_feed.csv‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
11
extension_id,extension_name,wildcard_pattern,category,threat_type,reference_url,description,chrome_webstore_url,severity,crx_sha256,first_seen,feed_source
2+
kghcdbkokgjghlfeojcpeoclfnljkbdk,Video Downloader,*kghcdbkokgjghlfeojcpeoclfnljkbdk*,malware,malicious,https://www.koi.ai/blog/a-month-of-malware-in-the-chrome-web-store,,https://chromewebstore.google.com/detail/kghcdbkokgjghlfeojcpeoclfnljkbdk,critical,,2026-07-10,ExtSentry (github.com/mthcht/awesome-lists)
3+
ndhaplegimoabombidcdfogcnpmcicik,Bass Booster,*ndhaplegimoabombidcdfogcnpmcicik*,malware,malicious,https://www.koi.ai/blog/a-month-of-malware-in-the-chrome-web-store,,https://chromewebstore.google.com/detail/ndhaplegimoabombidcdfogcnpmcicik,critical,,2026-07-10,ExtSentry (github.com/mthcht/awesome-lists)
4+
ompafndkajgkoldjbgnbikogdkljinlb,Downloader For Instagram,*ompafndkajgkoldjbgnbikogdkljinlb*,malware,malicious,https://www.koi.ai/blog/a-month-of-malware-in-the-chrome-web-store,,https://chromewebstore.google.com/detail/ompafndkajgkoldjbgnbikogdkljinlb,critical,,2026-07-10,ExtSentry (github.com/mthcht/awesome-lists)
5+
bhfelhfpjghfmhogedjnlmdpkbhmjhlf,Downloader For Instagram,*bhfelhfpjghfmhogedjnlmdpkbhmjhlf*,malware,malicious,https://www.koi.ai/blog/a-month-of-malware-in-the-chrome-web-store,,https://chromewebstore.google.com/detail/bhfelhfpjghfmhogedjnlmdpkbhmjhlf,critical,,2026-07-10,ExtSentry (github.com/mthcht/awesome-lists)
26
jkhapebnlgocjncbbfccgiepjlghehmj,Surfshark VPN,*jkhapebnlgocjncbbfccgiepjlghehmj*,PROXY/VPN,Defense Evasion,https://microsoftedge.microsoft.com/addons/detail/jkhapebnlgocjncbbfccgiepjlghehmj,,https://chromewebstore.google.com/detail/jkhapebnlgocjncbbfccgiepjlghehmj,high,,2026-07-10,ExtSentry (github.com/mthcht/awesome-lists)
37
jplnlifepflhkbkgonidnobkakhmpnmh,Private Internet Access – Proxy for Chrome,*jplnlifepflhkbkgonidnobkakhmpnmh*,PROXY/VPN,Defense Evasion,https://chromewebstore.google.com/detail/private-internet-access-%E2%80%93/jplnlifepflhkbkgonidnobkakhmpnmh,,https://chromewebstore.google.com/detail/jplnlifepflhkbkgonidnobkakhmpnmh,high,,2026-07-10,ExtSentry (github.com/mthcht/awesome-lists)
48
hhdobjgopfphlmjbmnpglhfcgppchgje,AdGuard VPN: free & secure proxy,*hhdobjgopfphlmjbmnpglhfcgppchgje*,PROXY/VPN,Defense Evasion,https://chromewebstore.google.com/detail/adguard-vpn-free-secure-p/hhdobjgopfphlmjbmnpglhfcgppchgje,,https://chromewebstore.google.com/detail/hhdobjgopfphlmjbmnpglhfcgppchgje,high,,2026-07-10,ExtSentry (github.com/mthcht/awesome-lists)

‎feeds/ioc_all_extension_ids.txt‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
kghcdbkokgjghlfeojcpeoclfnljkbdk
2+
ndhaplegimoabombidcdfogcnpmcicik
3+
ompafndkajgkoldjbgnbikogdkljinlb
4+
bhfelhfpjghfmhogedjnlmdpkbhmjhlf
15
jkhapebnlgocjncbbfccgiepjlghehmj
26
jplnlifepflhkbkgonidnobkakhmpnmh
37
hhdobjgopfphlmjbmnpglhfcgppchgje

‎feeds/ioc_malicious_extension_ids.txt‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
kghcdbkokgjghlfeojcpeoclfnljkbdk
2+
ndhaplegimoabombidcdfogcnpmcicik
3+
ompafndkajgkoldjbgnbikogdkljinlb
4+
bhfelhfpjghfmhogedjnlmdpkbhmjhlf
15
jkhapebnlgocjncbbfccgiepjlghehmj
26
jplnlifepflhkbkgonidnobkakhmpnmh
37
hhdobjgopfphlmjbmnpglhfcgppchgje

‎feeds/misp_event.json‎

Lines changed: 249 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
"analysis": "2",
66
"distribution": "3",
77
"date": "2026-07-10",
8-
"timestamp": "1783688207",
8+
"timestamp": "1783697448",
99
"published": false,
1010
"uuid": "41ef2090-fab5-547e-9eb6-2aa8f195c66f",
1111
"Orgc": {
@@ -27,6 +27,74 @@
2727
}
2828
],
2929
"Attribute": [
30+
{
31+
"uuid": "97d3d526-e3f3-5e70-8f70-2bd15c645364",
32+
"type": "text",
33+
"category": "Other",
34+
"to_ids": false,
35+
"value": "kghcdbkokgjghlfeojcpeoclfnljkbdk",
36+
"comment": "Video Downloader | Category: malware | Type: malicious | ",
37+
"distribution": "5",
38+
"Tag": [
39+
{
40+
"name": "extsentry:category=\"malware\""
41+
},
42+
{
43+
"name": "extsentry:type=\"malicious\""
44+
}
45+
]
46+
},
47+
{
48+
"uuid": "4e8ce728-fcf6-5a40-a361-80b710704df6",
49+
"type": "text",
50+
"category": "Other",
51+
"to_ids": false,
52+
"value": "ndhaplegimoabombidcdfogcnpmcicik",
53+
"comment": "Bass Booster | Category: malware | Type: malicious | ",
54+
"distribution": "5",
55+
"Tag": [
56+
{
57+
"name": "extsentry:category=\"malware\""
58+
},
59+
{
60+
"name": "extsentry:type=\"malicious\""
61+
}
62+
]
63+
},
64+
{
65+
"uuid": "6a5b29d4-cfd6-54bf-baac-44b116f49a36",
66+
"type": "text",
67+
"category": "Other",
68+
"to_ids": false,
69+
"value": "ompafndkajgkoldjbgnbikogdkljinlb",
70+
"comment": "Downloader For Instagram | Category: malware | Type: malicious | ",
71+
"distribution": "5",
72+
"Tag": [
73+
{
74+
"name": "extsentry:category=\"malware\""
75+
},
76+
{
77+
"name": "extsentry:type=\"malicious\""
78+
}
79+
]
80+
},
81+
{
82+
"uuid": "692e9fd3-2fb0-5e24-a38f-3a43271128b6",
83+
"type": "text",
84+
"category": "Other",
85+
"to_ids": false,
86+
"value": "bhfelhfpjghfmhogedjnlmdpkbhmjhlf",
87+
"comment": "Downloader For Instagram | Category: malware | Type: malicious | ",
88+
"distribution": "5",
89+
"Tag": [
90+
{
91+
"name": "extsentry:category=\"malware\""
92+
},
93+
{
94+
"name": "extsentry:type=\"malicious\""
95+
}
96+
]
97+
},
3098
{
3199
"uuid": "6e017e6b-f9e2-5bee-bea5-b00dbbd1915a",
32100
"type": "text",
@@ -34998,6 +35066,186 @@
3499835066
}
3499935067
],
3500035068
"Object": [
35069+
{
35070+
"uuid": "55d6a9d5-4ca9-5aad-aeb6-9fb8d537f86a",
35071+
"name": "annotation",
35072+
"meta-category": "misc",
35073+
"description": "Suspicious/Malicious browser extension: Video Downloader",
35074+
"template_uuid": "e434b304-a905-53fb-b7df-1d552e338795",
35075+
"template_version": "1",
35076+
"Attribute": [
35077+
{
35078+
"object_relation": "text",
35079+
"type": "text",
35080+
"value": "kghcdbkokgjghlfeojcpeoclfnljkbdk",
35081+
"comment": "Browser Extension ID",
35082+
"to_ids": false
35083+
},
35084+
{
35085+
"object_relation": "text",
35086+
"type": "text",
35087+
"value": "Video Downloader",
35088+
"comment": "Extension Name",
35089+
"to_ids": false
35090+
},
35091+
{
35092+
"object_relation": "text",
35093+
"type": "text",
35094+
"value": "malware",
35095+
"comment": "Threat Category",
35096+
"to_ids": false
35097+
},
35098+
{
35099+
"object_relation": "text",
35100+
"type": "text",
35101+
"value": "malicious",
35102+
"comment": "Threat Type",
35103+
"to_ids": false
35104+
},
35105+
{
35106+
"object_relation": "text",
35107+
"type": "link",
35108+
"value": "https://www.koi.ai/blog/a-month-of-malware-in-the-chrome-web-store",
35109+
"comment": "Reference URL",
35110+
"to_ids": false
35111+
}
35112+
]
35113+
},
35114+
{
35115+
"uuid": "7802425e-3638-5bd7-a0df-4b39a3de2c62",
35116+
"name": "annotation",
35117+
"meta-category": "misc",
35118+
"description": "Suspicious/Malicious browser extension: Bass Booster",
35119+
"template_uuid": "e434b304-a905-53fb-b7df-1d552e338795",
35120+
"template_version": "1",
35121+
"Attribute": [
35122+
{
35123+
"object_relation": "text",
35124+
"type": "text",
35125+
"value": "ndhaplegimoabombidcdfogcnpmcicik",
35126+
"comment": "Browser Extension ID",
35127+
"to_ids": false
35128+
},
35129+
{
35130+
"object_relation": "text",
35131+
"type": "text",
35132+
"value": "Bass Booster",
35133+
"comment": "Extension Name",
35134+
"to_ids": false
35135+
},
35136+
{
35137+
"object_relation": "text",
35138+
"type": "text",
35139+
"value": "malware",
35140+
"comment": "Threat Category",
35141+
"to_ids": false
35142+
},
35143+
{
35144+
"object_relation": "text",
35145+
"type": "text",
35146+
"value": "malicious",
35147+
"comment": "Threat Type",
35148+
"to_ids": false
35149+
},
35150+
{
35151+
"object_relation": "text",
35152+
"type": "link",
35153+
"value": "https://www.koi.ai/blog/a-month-of-malware-in-the-chrome-web-store",
35154+
"comment": "Reference URL",
35155+
"to_ids": false
35156+
}
35157+
]
35158+
},
35159+
{
35160+
"uuid": "b2e0385b-4f97-55c3-98de-15a5501cbd25",
35161+
"name": "annotation",
35162+
"meta-category": "misc",
35163+
"description": "Suspicious/Malicious browser extension: Downloader For Instagram",
35164+
"template_uuid": "e434b304-a905-53fb-b7df-1d552e338795",
35165+
"template_version": "1",
35166+
"Attribute": [
35167+
{
35168+
"object_relation": "text",
35169+
"type": "text",
35170+
"value": "ompafndkajgkoldjbgnbikogdkljinlb",
35171+
"comment": "Browser Extension ID",
35172+
"to_ids": false
35173+
},
35174+
{
35175+
"object_relation": "text",
35176+
"type": "text",
35177+
"value": "Downloader For Instagram",
35178+
"comment": "Extension Name",
35179+
"to_ids": false
35180+
},
35181+
{
35182+
"object_relation": "text",
35183+
"type": "text",
35184+
"value": "malware",
35185+
"comment": "Threat Category",
35186+
"to_ids": false
35187+
},
35188+
{
35189+
"object_relation": "text",
35190+
"type": "text",
35191+
"value": "malicious",
35192+
"comment": "Threat Type",
35193+
"to_ids": false
35194+
},
35195+
{
35196+
"object_relation": "text",
35197+
"type": "link",
35198+
"value": "https://www.koi.ai/blog/a-month-of-malware-in-the-chrome-web-store",
35199+
"comment": "Reference URL",
35200+
"to_ids": false
35201+
}
35202+
]
35203+
},
35204+
{
35205+
"uuid": "d166ba60-14cd-504d-a609-4b16269de1cd",
35206+
"name": "annotation",
35207+
"meta-category": "misc",
35208+
"description": "Suspicious/Malicious browser extension: Downloader For Instagram",
35209+
"template_uuid": "e434b304-a905-53fb-b7df-1d552e338795",
35210+
"template_version": "1",
35211+
"Attribute": [
35212+
{
35213+
"object_relation": "text",
35214+
"type": "text",
35215+
"value": "bhfelhfpjghfmhogedjnlmdpkbhmjhlf",
35216+
"comment": "Browser Extension ID",
35217+
"to_ids": false
35218+
},
35219+
{
35220+
"object_relation": "text",
35221+
"type": "text",
35222+
"value": "Downloader For Instagram",
35223+
"comment": "Extension Name",
35224+
"to_ids": false
35225+
},
35226+
{
35227+
"object_relation": "text",
35228+
"type": "text",
35229+
"value": "malware",
35230+
"comment": "Threat Category",
35231+
"to_ids": false
35232+
},
35233+
{
35234+
"object_relation": "text",
35235+
"type": "text",
35236+
"value": "malicious",
35237+
"comment": "Threat Type",
35238+
"to_ids": false
35239+
},
35240+
{
35241+
"object_relation": "text",
35242+
"type": "link",
35243+
"value": "https://www.koi.ai/blog/a-month-of-malware-in-the-chrome-web-store",
35244+
"comment": "Reference URL",
35245+
"to_ids": false
35246+
}
35247+
]
35248+
},
3500135249
{
3500235250
"uuid": "401212c5-e813-5a84-938c-48e8f64c848a",
3500335251
"name": "annotation",

‎feeds/misp_warninglist.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@
99
"other"
1010
],
1111
"list": [
12+
"kghcdbkokgjghlfeojcpeoclfnljkbdk",
13+
"ndhaplegimoabombidcdfogcnpmcicik",
14+
"ompafndkajgkoldjbgnbikogdkljinlb",
15+
"bhfelhfpjghfmhogedjnlmdpkbhmjhlf",
1216
"jkhapebnlgocjncbbfccgiepjlghehmj",
1317
"jplnlifepflhkbkgonidnobkakhmpnmh",
1418
"hhdobjgopfphlmjbmnpglhfcgppchgje",

0 commit comments

Comments
 (0)