← back to portfolio
Malware
TabFlow Pro: USB-Delivered Malicious Browser Extension
Executive Summary
An unauthorized individual gained brief physical access to workstation WKSTN-ORION-014 overnight,
connecting a USB mass storage device and leaving a malicious Chrome extension installed under the
guise of "TabFlow Pro." The extension was sideloaded outside the Chrome Web Store, granted itself
broad browser permissions, and established persistence via a Registry Run key executing a background
service binary. Its code was built to harvest credentials and session cookies from a defined list of
target domains, obfuscate the stolen data with a single-byte XOR key and Base64, and exfiltrate it to
a remote C2 endpoint. One recovered artifact timestamp is internally inconsistent with the rest of the
timeline and is flagged rather than treated as fact.
Scenario
Late at night, an unauthorized entry was reported into an operations bay. Security footage captured an
unknown individual at workstation WKSTN-ORION-014 — assigned to operations engineer James Harris
(jharris) — connecting a removable drive, spending a few minutes at the keyboard, and leaving. By
the time security swept the floor, the workstation had been left unlocked.
The following morning, endpoint telemetry flagged a Chrome extension in Harris's browser profile that
did not originate from the company's managed deployment channel. A triaged disk image of the
workstation was captured, along with the recovered extension source and two staging scripts.
Some artifacts on the host appeared deliberately planted or internally inconsistent with each other.
Separating what could be proven from what could only be inferred was treated as a core part of this
investigation.
Evidence Collected
| Artifact | Value | Why It Mattered |
|---|
| USB Mass Storage VID/PID | VID_23A9&PID_EF18 | Identified the physical device used for initial access |
| LNK Target | E:\TabFlowPro | Confirmed execution originated from the removable drive |
| Staging Script | install_extension.ps1 | Installed the malicious extension after ExecutionPolicy bypass |
| Extension ID | djflhoibgkdhkhhcedjiklpkjnoahfmg | Uniquely identified the extension in the Chrome profile |
| Chrome Web Store Origin | False | Confirmed the extension was sideloaded, not officially distributed |
| Granted API Permissions | 9 | Indicated broad access requested by the extension |
| Registry Run Key | HKCU\...\Run\TabFlowServiceHost | Persistence mechanism surviving reboot |
| Run Key Command Line | mshost_service.exe --background --no-window | Revealed the hidden background process launched at logon |
| C2 Host (background.js) | api.tabflow-cdn[.]net | Identified the exfiltration endpoint |
| XOR Key | 0x5A | Confirmed obfuscation method for outbound payloads |
| Target Domain Count | 12 | Scope of domains the extension filtered cookies for |
Timeline
| Time (UTC) | Event | Source |
|---|
| 2026-04-16 23:21:04 | USB mass storage device installation completed | Registry |
| 2026-04-16 23:29:36 | install_extension.ps1 execution failed — script execution disabled | PowerShell operational log |
| 2026-04-16 23:29:50 | Set-ExecutionPolicy Bypass -Scope Process -Force executed; install_extension.ps1 re-run successfully | PowerShell operational log |
| 2026-04-16 23:31:34 | HKCU\...\Run\TabFlowServiceHost persistence value created | Registry (NTUSER.dat) |
Elapsed time from USB installation to persistence establishment: 630 seconds (10m 30s).
Key Findings
- USB mass storage device VID_23A9&PID_EF18 completed installation at 23:21:04 UTC, containing TabFlowPro.lnk pointing to E:\TabFlowPro.
- The first attempt to run install_extension.ps1 (23:29:36 UTC) failed because script execution was disabled; 14 seconds later the execution policy was bypassed (Set-ExecutionPolicy Bypass -Scope Process -Force) and the script re-run successfully.
- The TabFlow Pro extension was not installed from the Chrome Web Store and was granted 9 API permissions.
- Persistence was established via a Registry Run key launching mshost_service.exe in the background, 630 seconds after USB installation.
- The extension's background.js harvests login credentials, session cookies (across 12 target domains), open tab data, and basic system info, sending it to a hardcoded C2 endpoint.
- Exfiltrated data is obfuscated with a single-byte XOR key (0x5A) and Base64-encoded before transmission.
- The extension's install_time value recovered from Chrome's Preferences file resolves to 2024-08-31 — predating the observed compromise by over a year. This is treated as an unreliable or planted artifact rather than a genuine install timestamp, since this field is trivially editable and inconsistent with every other observed event.
Attack Chain
Initial Access
Unauthorized physical access; USB mass storage device connected to the unlocked workstation.
Execution
TabFlowPro.lnk executed from the USB drive; install_extension.ps1 initially failed (scripts disabled), then ran successfully after an ExecutionPolicy bypass.
Installation
Malicious Chrome extension sideloaded into the browser profile outside the Web Store, granted broad API permissions.
Persistence
Registry Run key created to launch a hidden background service binary at logon.
Collection
Extension captures credentials from login forms, session cookies across 12 domains, and browser/system metadata.
Exfiltration
Stolen data XOR-obfuscated and Base64-encoded, sent to a hardcoded C2 endpoint over HTTPS.
Analyst Notes
Correlated USB device installation, LNK execution, and PowerShell activity to establish the initial access vector.
Confirmed the extension was sideloaded (not Web Store-sourced) via its installation metadata and lack of a store listing.
Traced persistence to a Registry Run key launching a background executable disguised as a service host.
Reviewed the extension's background.js source directly to confirm C2 destination, exfiltration triggers, and obfuscation method rather than relying on network traffic alone.
Flagged the Preferences install_time value as inconsistent with the rest of the timeline — treated as unreliable rather than incorporated into the confirmed sequence of events, per the assignment's emphasis on separating proof from inference.