Lucky_Cat__2021__proofpoint.com-TA413_Leverages_New_FriarFox_Browser_Extension_to_Target_the_Gmail_Accounts_of_Global_Tibetan_Organiz.pdf

TA413, an actor aligned with Chinese state interests, used phishing and watering-hole lures to deliver a malicious Firefox extension called FriarFox — a modified Gmail Notifier — to target Gmail accounts of Tibetan organizations; FriarFox granted broad Gmail and browser permissions and retrieved the Scanbox reconnaissance framework from actor-controlled domains for data collection and exfiltration, with multiple IOCs and infrastructure links to prior TA413 campaigns provided.