securitytabs

Firefox Profile Payload

MentionsMozillaFirefoxMicrosoftMicrosoft Windows

Plays from YouTube in privacy-enhanced mode — nothing loads from YouTube until you press play.

This payload uses a few simple Windows commands in a clever way to search through Firefox profile files and identify a specific file to execute. It is a small part of a broader malware analysis that looks at how attackers can abuse built-in Windows functionality to carry out their payloads. Watch the full video: https://youtu.be/oJHOlNTH7lY?si=8LruOkxZlfvFLII-

Description from John Hammond.

More in Threat Intel