In this talk, we’ll be deep diving into malicious JavaScript code, using the ChromeLoader campaign as an example. We will demonstrate widely used payload encryption and JavaScript obfuscation techniques, and how to reverse engineer the code.

The talk will cover:

1. What browser hijacking threats are and the impact and motivation behind them.
2. How legitimate browser extensions are loaded, their code structure, and demo a clean extension.
3. Common techniques for side-loading malicious browser extensions.
4. A walkthrough of the ChromeLoader malware campaign, covering the timeline, attack chain, and payload delivery mechanism.
5. A deep dive into various JavaScript obfuscation techniques (dead code injection, string array encoding, hex conversion, etc) used during the campaign, and the approach for de-obfuscating and debugging malicious extension files.
6. Other prevalent malware families (FakeUpdates, Fauppod, etc) using different JavaScript obfuscation techniques.
7. Advice on protection against browser hijacking threats.