Loading malware…
Rilide is a Chromium-focused information-stealing malware family implemented as a malicious browser extension. Public reporting since 2023 has linked it to financially motivated activity centered on theft of browser-stored credentials, session cookies, financial information, and cryptocurrency-related data. It has been observed monitoring visited URLs, capturing screenshots of browser tabs, and injecting remotely retrieved JavaScript into selected websites, enabling targeted theft from webmail, exchange, and wallet-related services. Some reporting also describes password logging and collection of cryptocurrency wallet credentials.
Rilide has been delivered through multiple intrusion chains. Observed methods include loaders and droppers that silently install and hide the extension inside Chromium-based browsers, as well as persistence mechanisms that abuse modified browser shortcuts to force-load the extension at startup. It has also been deployed by the OkoBot framework, whose browser-injection components install hidden malicious extensions in Chromium browsers. In those campaigns, Rilide formed part of a broader credential- and cryptocurrency-theft ecosystem that also included surveillance, keylogging, and wallet-focused phishing modules.
The malware targets Chromium-based browsers on Windows endpoints and has been associated with Russian-speaking cybercrime ecosystems. Reporting has noted its use by Russian-speaking threat actors and its circulation in closed Russian-language criminal forums. Victimology observed in related campaigns spans multiple countries and sectors, with emphasis on financially motivated theft rather than destructive effects.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
During the attack, the Rilide extension was installed on the victim’s system using the previously described loader. Rilide is a stealer targeting Chromium-based browsers.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
“modified to include malicious capabilities such as keylogging” and “content.js file was used to collect information on websites… injected into all URLs before creating the DOM.”
Тот собирает информацию о системе, похищает файлы криптокошельков, профили браузеров, файлы cookie и учетные данные, а затем загружает дополнительные модули.
“modified to include malicious capabilities such as keylogging” and “content.js file was used to collect information on websites… injected into all URLs before creating the DOM.”
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A browser stealer deployed by an OkoBot module via hidden Chromium extensions.
Стилер, распространявшийся через OkoBot в виде вредоносного расширения для браузера; предназначен для кражи учетных данных, cookie, финансовых данных и криптовалюты.
Malicious browser extension deployed by OkoBot as part of follow-on activity.
A malicious browser extension used to steal credentials, cookies, financial information, and cryptocurrency-related data from Chrome browsers.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.