INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

DuckDuckGo Chrome.exe Compromised by Malicious Media Operation Bokep

| 2026-09-16 21:51 MEDIUM HIGH DATA BREACH MALWARE & BOTNETS
JSON
Executive Summary
AI-generated
On September 15th, 2026, a sophisticated cyber operation was launched targeting home networks in the United States of America and Malaysia. The attack involved a malicious link and file attached to search engines such as DuckDuckGo and Google, which compromised devices running Apple, Android, and Windows operating systems. Once infected, targeted devices were exposed to multiple botnets, resulting in credential dumps, spyware, and financial loss for the victims. The attackers used various tactics including drive-by compromise, malicious media, and persistence to infect devices, with malware families such as Trojan:Win32/GandCrab and Win.Virus.PolyRansom-5704625-0 detected.
Technical Mitigations AI-generated
• Audit (ATT&CK mitigation for Phishing): Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. • Network Intrusion Prevention (ATT&CK mitigation for Phishing): Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity. • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 26 IoCs Create Free Account
hxxp://••••••••••••••••••••
e19238••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
ma•••••.com
ww•••••.com
ho•••••.com
il•••••.com
Ch•••••.exe
ch•••••.exe
162.251.•••.•••
43.231.•••.•••
105.62.•••.•••
49.1.•••.•••
4a3313••••••••••••••••••••••••••
57c8ed••••••••••••••••••••••••••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
EmotetEmotet
Target & Sectors
NORTH_AMERICA NORTH_AMERICA DACH DACH financefinance
Incident Timeline
‎september 15th 2026
Threat actors exploited vulnerabilities in Chrome.exe to deliver malicious media, resulting in a drive-by compromise that led to credential dumping and the installation of spyware targeting finance entities on September 15th, 2026.
industry Finance
General Document Context
‎2026/09/16
Threat actors used Chrome.exe spyware to target individuals in the United States of America and Malaysia, compromising their home networks and stealing web session cookies.
organisation Chrome.exe Spyware
DuckDuckGo , Chrome.exe Spyware | Credential Dumping | Malicious Media | Drive by compromise | Opereation Bokep.
organisation Credential Dumping
DuckDuckGo , Chrome.exe Spyware | Credential Dumping | Malicious Media | Drive by compromise | Opereation Bokep.
organisation Opereation Bokep
DuckDuckGo , Chrome.exe Spyware | Credential Dumping | Malicious Media | Drive by compromise | Opereation Bokep.
organisation Google
(Umbald 4a3313413c6c41507bec45ce2fdf80d5 + ilovetehp*****y.host4star.com coded Victim couldn’t see redirect to insecure header landing DuckDuckGo Go or Google as intended.
infrastructure Android
malicious link and file attached to DDG and Google.. Targets home networks, Apple , Android all devices were compromised by suspected threat actors.
organisation DDG
malicious link and file attached to DDG and Google.. Targets home networks, Apple , Android all devices were compromised by suspected threat actors.
organisation Apple
malicious link and file attached to DDG and Google.. Targets home networks, Apple , Android all devices were compromised by suspected threat actors.
organisation credential dumps & spyware
Major issues with credential dumps & spyware.
organisation Target
Target suffered financial loss , banking issues , email & account theft, reputation damage & malicious solicitations and other related crimes.
Tactical Metrics
Metrics
infrastructure
‎Android
Affected Product
malicious link and file attached to DDG and Google.. Targets home networks, Apple , Android all devices were compromised by suspected threat actors.
Intelligence Sources
AlienVault OTX 2026-09-16