MalwareUsed by 1 actor

SmashJacker

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Charcoal Stork

The emergence of SmashJacker, a payload distinct from ChromeLoader but that also stemmed from Charcoal Stork initial access, led to our decision to continue tracking Charcoal Stork separately.

via red canary threat reportredcanary.com

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques

T1583Acquire InfrastructureEvidence1

Analysis of SmashJacker and ChromeLoader MSI files delivered via concurrent Charcoal Stork campaigns showed several distinctions that led us to suspect Charcoal Stork is a pay-per-install (PPI) provider, responsible for the file naming and SEO and/or malvertising to get the click.

T1588.001MalwareEvidence1

SmashJacker was not built with Advanced Installer and instead installs a trojanized version of 7zip, which installs the malicious extension.

Initial Access

1 technique

T1189Drive-by CompromiseEvidence1

MITRE ATT&CK Techniques Utilized T1189 – Drive-by Compromise

Execution

3 techniques

T1053.005Scheduled TaskEvidence1

reg.xml is an xml formatted scheduled task that runs every 5 minutes and runs the persistence executable that created it.

T1059.003Windows Command ShellEvidence1

Lastly, another batch file for the targeted browser is created that handles installing the extension.

T1204.002Malicious FileEvidence1

Users are lured to download the installer files by having them hosted on pages advertising the download of wallpapers, software, games, and movies, typically illegally.

Persistence

4 techniques

T1053.005Scheduled TaskEvidence1

reg.xml is an xml formatted scheduled task that runs every 5 minutes and runs the persistence executable that created it.

T1112Modify RegistryEvidence1

First it adds keys for the extension's id in the targeted browser's Extension and ExtensionInstallAllowList registry keys with the path to the extension's .crx file.

T1176Software ExtensionsEvidence2

MITRE ATT&CK Techniques Utilized T1176 – Browser Extensions

T1546.010AppInit DLLsEvidence1

Sometimes it would use the AppInit_DLLs registry value to persist by calling the reg command.

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

reg.xml is an xml formatted scheduled task that runs every 5 minutes and runs the persistence executable that created it.

T1546.010AppInit DLLsEvidence1

Sometimes it would use the AppInit_DLLs registry value to persist by calling the reg command.

Stealth

3 techniques

T1036MasqueradingEvidence1

Pulling that thread led us to an interesting pattern of files masquerading as cracked games and software or wallpaper downloads.

T1070.004File DeletionEvidence1

First it will check if a URL contains either 7fk8qechol ... or the extension's id. If either of those are present it will close the tab.

T1218System Binary Proxy ExecutionEvidence1

This makes it so that the dropped dll is executed every time a process is created, and if it's one of the targeted browsers then the dll will make sure the extension files exist...

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

First it adds keys for the extension's id in the targeted browser's Extension and ExtensionInstallAllowList registry keys with the path to the extension's .crx file.

Impact

1 technique

T1565.002Transmitted Data ManipulationEvidence1

MITRE ATT&CK Techniques Utilized T1565.002 – Data Manipulation: Transmitted Data Manipulation

INDICATORS OF COMPROMISE

IOCs tracked for this family

128 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

36 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

87 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

5 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app8 months ago

hash.sha1●●●●●●●●●●●●View more in app8 months ago

hash.sha256●●●●●●●●●●●●View more in app8 months ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

red canary threat reportNews

Jan 1, 2026

Charcoal Stork - Red Canary Threat Detection Report

A payload delivered by Charcoal Stork. Unlike ChromeLoader, it was not built with Advanced Installer and instead installs a trojanized version of 7zip, which installs a malicious browser extension.

red canary threat reportNews

Jan 1, 2026

ChromeLoader - Red Canary Threat Detection Report

Distinct payload delivered following Charcoal Stork initial access; no further functional detail is provided in the content.

connectwiseNews

Jan 1, 2026

SmashJacker | ConnectWise Threat Report

A persistent malicious Chromium extension delivered via trojanized installers from piracy-themed sites. It hijacks browser searches, redirects users through actor-controlled affiliate infrastructure, generates ad revenue, collects victim analytics, and uses registry policy abuse, scheduled tasks, or AppInit DLLs for persistence while resisting removal.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching128

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

SmashJacker

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Charcoal Stork

The emergence of SmashJacker, a payload distinct from ChromeLoader but that also stemmed from Charcoal Stork initial access, led to our decision to continue tracking Charcoal Stork separately.

via red canary threat reportredcanary.com

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques

T1583Acquire InfrastructureEvidence1

T1588.001MalwareEvidence1

SmashJacker was not built with Advanced Installer and instead installs a trojanized version of 7zip, which installs the malicious extension.

Initial Access

1 technique

T1189Drive-by CompromiseEvidence1

MITRE ATT&CK Techniques Utilized T1189 – Drive-by Compromise

Execution

3 techniques

T1053.005Scheduled TaskEvidence1

reg.xml is an xml formatted scheduled task that runs every 5 minutes and runs the persistence executable that created it.

T1059.003Windows Command ShellEvidence1

Lastly, another batch file for the targeted browser is created that handles installing the extension.

T1204.002Malicious FileEvidence1

Users are lured to download the installer files by having them hosted on pages advertising the download of wallpapers, software, games, and movies, typically illegally.

Persistence

4 techniques

T1053.005Scheduled TaskEvidence1

reg.xml is an xml formatted scheduled task that runs every 5 minutes and runs the persistence executable that created it.

T1112Modify RegistryEvidence1

First it adds keys for the extension's id in the targeted browser's Extension and ExtensionInstallAllowList registry keys with the path to the extension's .crx file.

T1176Software ExtensionsEvidence2

MITRE ATT&CK Techniques Utilized T1176 – Browser Extensions

T1546.010AppInit DLLsEvidence1

Sometimes it would use the AppInit_DLLs registry value to persist by calling the reg command.

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

reg.xml is an xml formatted scheduled task that runs every 5 minutes and runs the persistence executable that created it.

T1546.010AppInit DLLsEvidence1

Sometimes it would use the AppInit_DLLs registry value to persist by calling the reg command.

Stealth

3 techniques

T1036MasqueradingEvidence1

Pulling that thread led us to an interesting pattern of files masquerading as cracked games and software or wallpaper downloads.

T1070.004File DeletionEvidence1

First it will check if a URL contains either 7fk8qechol ... or the extension's id. If either of those are present it will close the tab.

T1218System Binary Proxy ExecutionEvidence1

This makes it so that the dropped dll is executed every time a process is created, and if it's one of the targeted browsers then the dll will make sure the extension files exist...

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

First it adds keys for the extension's id in the targeted browser's Extension and ExtensionInstallAllowList registry keys with the path to the extension's .crx file.

Impact

1 technique

T1565.002Transmitted Data ManipulationEvidence1

MITRE ATT&CK Techniques Utilized T1565.002 – Data Manipulation: Transmitted Data Manipulation

INDICATORS OF COMPROMISE

IOCs tracked for this family

128 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

36 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

87 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

5 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app8 months ago

hash.sha1●●●●●●●●●●●●View more in app8 months ago

hash.sha256●●●●●●●●●●●●View more in app8 months ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

red canary threat reportNews

Jan 1, 2026

Charcoal Stork - Red Canary Threat Detection Report

A payload delivered by Charcoal Stork. Unlike ChromeLoader, it was not built with Advanced Installer and instead installs a trojanized version of 7zip, which installs a malicious browser extension.

red canary threat reportNews

Jan 1, 2026

ChromeLoader - Red Canary Threat Detection Report

Distinct payload delivered following Charcoal Stork initial access; no further functional detail is provided in the content.

connectwiseNews

Jan 1, 2026

SmashJacker | ConnectWise Threat Report

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching128

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.