Sleeper Sound: LayerX Uncovers Malicious “Sleeper” Sound Management Extensions with Nearly 1.5 Million Users Worldwide

LayerX has discovered a network of browser extensions that appear to serve as ‘sleeper agents’ for future malicious activity. The extensions appear to have all been developed by the same person or group, waiting for their “marching order” to execute malicious code on unsuspecting users’ computers. 

The extensions that LayerX has identified all seem to be focused on in-browser sound management. While the extensions attempt to disguise their common parameters (common code base, common external communication destinations, etc.), and try to demonstrate legitimate functionality, an analysis of the code reveals a very different story:

• Common Code with Known Malicious Extensions: Common code patterns were found across these extensions that have previously been identified as malicious and taken off of the Chrome Web Store.
• Loading External Configuration Files to Execute Commands: The common code patterns enable the extension, among other capabilities, to execute remote instructions without those commands appearing in the codebase, thereby circumventing traditional code scanning techniques.
• Opening Background Tabs and executing commands: This allows the extension to execute commands without the user knowing about it. Examples of such commands can be, for example, accessing an external URL and downloading malware.
• Communicating with Known Malicious URLs: The extensions communicate with external URLs, including known malicious domains.
• Traffic Encryption: The extensions also use encryption and base64 code obfuscation to encrypt external communications and obfuscate their behavior.

Needless to say, these capabilities do not appear to have any legitimate use in relation to the supposed function of the extensions. 

Currently, LayerX has identified four such extensions (see below for full details), with over 1.2 million users worldwide. LayerX is also currently investigating several additional extensions that appear to be linked to this campaign. All extensions are still currently available on the Chrome Store.

This infrastructure is not unique to ReadBee—similar malicious code structures have been found in other extensions as well. For example, the Search ChatGPT extension (acagjkjeebjdmeipgmhcmaddekfmdbaj) used the same communication and control patterns and was removed from the Chrome Web Store on October 25, 2024, due to malware.

Some of the domains that these extensions communicate with have been flagged as known malicious URLs on VirusTotal:

• https://francjohn[.]com/api/action/

Another domain is the extensions are seen to communication with is:

• https://jermikro[.]com/api/

Three of the extensions communicate with this domain. While that domain itself has not been flagged as malicious, the underlying of that domain has been flagged in the past for malware activity.

Moreover, the extensions also use various encryption techniques within the code to encrypt external communications and obfuscate their behavior.

Another key factor is that while the extensions all seem to share a common code base (at least for the malicious bits), a common theme (all of them appear to be centred on in-browser sound management), and common external communications, outwardly, they all show different ownership:

• Each extension is listed under a different publisher, with different contact details.
• None of the extensions have public-facing websites.
• The contact information for each extension leads to anonymous webmail accounts.

As a result, it is impossible to ascertain the identity of the people behind each of these extensions.

Below is the current list of suspected malicious extensions identified as part of this ring:

While VirusTotal is mostly known as a repository for flagging the domains / IPs of malware command and control (C2) servers, it also includes some data on extensions.

Indeed, the the extension “Examine source code of Volume Max – Ultimate Sound Booster”, with over one million downloads, has already been flagged by several vendors. However, it was not removed from the Chrome Web Store.

Similarly, the “Sound Boster” extensions (over 200,000 users) has also been flagged by some security companies as malicious. It, too, remains available on the Chrome Web Store.

The analysis of the extensions is still ongoing, but so far LayerX has not identified any current malicious activities (apart from connections to known malicious extensions). Instead, this seems to be a platform or infrastructure for potential future malicious activity. This is why we are dubbing it a “sleeper” extension network.

This type of “sleeper” extension network can serve as a substitute for traditional botnets. While building up botnets (usually on exposed IoT devices) can be slow, technically complex, and cumbersome, developing a network of malicious browser extensions is much simpler, and can provide direct access to key user identity information such as cookies, passwords, browsing data, and browsing content.

There are a few key takeaways here:

1. Even seemingly innocuous extensions can be malicious: in this case, even though we did not see any active malicious behabior, we identified multiple links to known malicious extensions and/or domains, and code with capabilities that has no business being in extensions with the advertised capabilities.
2. Publisher reputation is a black hole: anyone can upload an extension, and it’s virtually impossible to trace back the people behind these extensions. In this case, for all the commonalieis, the extensions lead back to generic webmail addresses, and no public websites, and there’s no way to tell who’s behind them.
3. Extension security is a continuous process: it’s not a one-and-done, and seemingly innocent extensions can turn malicious, or malicious capabilities can be turned on/off. This is why continuously monitoring your browser extensions threat surface and security posture is crucial.