Incident Score: Analysis & Impact (MOZPHAGITPROGOOGIT1780935989)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing: Spearphishing Link (T1566.001) with high confidence (90%), supported by evidence indicating sent over 250 malicious emails with fake job offers and code-review requests and Phishing: Spearphishing Attachment (T1566.002) with moderate to high confidence (80%), supported by evidence indicating lure victims into cloning malicious GitHub or GitLab repositories. Under the Execution tactic, the analysis identified Command and Scripting Interpreter: JavaScript (T1059.007) with moderate to high confidence (80%), supported by evidence indicating windows ran JavaScript directly in the editor, leaving no disk footprint, User Execution: Malicious File (T1204.002) with moderate to high confidence (70%), supported by evidence indicating exploiting a legitimate editor feature via tasks.json file executed automatically, and Inter-Process Communication: Component Object Model (T1559.001) with moderate confidence (60%), supported by evidence indicating fake Google-themed VS Code extension ensuring persistence. Under the Persistence tactic, the analysis identified Event Triggered Execution: Installer Packages (T1546.016) with moderate to high confidence (80%), supported by evidence indicating fake Google-themed VS Code extension relaunching on macOS/Linux reopen and Boot or Logon Autostart Execution: Active Setup (T1547.014) with moderate to high confidence (70%), supported by evidence indicating malware installed a fake extension ensuring persistence. Under the Privilege Escalation tactic, the analysis identified Abuse Elevation Control Mechanism: Sudo and Sudo Caching (T1548.003) with moderate to high confidence (80%), supported by evidence indicating macOS/Linux displayed a fake password prompt to escalate privileges. Under the Defense Evasion tactic, the analysis identified Indicator Removal: File Deletion (T1070.004) with high confidence (90%), supported by evidence indicating after exfiltration, the malware deleted itself to evade detection, Deobfuscate/Decode Files or Information (T1140) with moderate confidence (60%), supported by evidence indicating malware likely used obfuscation to bypass security, and Hide Artifacts: Hidden Window (T1564.003) with moderate to high confidence (70%), supported by evidence indicating cursor ran the payload silently without user interaction. Under the Credential Access tactic, the analysis identified Credentials from Password Stores: Credentials from Web Browsers (T1555.003) with high confidence (90%), supported by evidence indicating targeted saved passwords & cookies from Chrome, Brave, Edge, and Firefox, Unsecured Credentials: Credentials In Files (T1552.001) with moderate to high confidence (80%), supported by evidence indicating dumped keychains on macOS/Linux using fake password prompt, and Steal Web Session Cookie (T1539) with moderate to high confidence (80%), supported by evidence indicating targeted browser cookies from Chrome, Brave, Edge, and Firefox. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating targeted cryptocurrency wallets and browser credentials and Automated Collection (T1119) with moderate to high confidence (70%), supported by evidence indicating malware targeted browser extensions and desktop wallets. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating go-based RAT from Overlord framework for remote access and Exfiltration Over Web Service: Exfiltration to Cloud Storage (T1567.002) with moderate confidence (60%), supported by evidence indicating malware likely exfiltrated data to attacker-controlled infrastructure. Under the Impact tactic, the analysis identified Resource Hijacking (T1496) with moderate to high confidence (80%), supported by evidence indicating cryptocurrency wallet drainage for financial gain. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.