Malware

Rilide

Rilide is a Chromium-based information-stealing malware family implemented as a malicious browser extension. It was first publicly reported by SpiderLabs in April 2023 and has been described by Mandiant as part of a broader email- and cryptocurrency-theft ecosystem. Rilide targets Chromium-based browsers and can be force-loaded for persistence via tampered Windows LNK shortcut files that launch a legitimate browser with the --load-extension switch; this technique applies to browsers such as Chrome, Brave, Microsoft Edge, Opera, and Vivaldi.

Observed capabilities include monitoring visited URLs, capturing screenshots of browser tabs, injecting remote JavaScript into selected websites, logging passwords, and collecting credentials including cryptocurrency wallet data. In one investigated intrusion chain, a TradingView-themed lure delivered the BRAINFOG dropper, which installed Rilide, killed running Chrome processes, replaced Chrome shortcuts, and configured the browser to load the extension invisibly. Mandiant also identified BRAINSTORM, a Rust-based dropper, and BRAINLINK, an Advanced Installer-compiled dropper, as associated with Rilide delivery.

Rilide communicates with command-and-control infrastructure to initialize infected hosts and retrieve targeting data. During execution it was observed calling /api/machine/init to obtain a machine identifier and a monitored-domain list, and re-fetching monitored domains every five minutes. Using DOMContentLoaded-triggered logic, it can request domain-to-script mappings from C2 and inject remote scripts such as coinbase.js, binance.js, gmail.js, hotmail.js, yahoo.js, bybit.js, and okx.js when victims browse targeted services. Reported targeted domains include coinbase.com, binance.com, blockchain.com, mail.google, outlook.live, mail.yahoo, bybit.com, and okx.com.

High-confidence infrastructure and delivery details mentioned in the content include C2/API paths at extenision-app[.]com/api/settings, /api/machine/, /api/machine/init, and /api/machine/get-urls, as well as a sample using the C2 domain ashgrrwt[.]click. One delivery chain downloaded a dropper from telegromcn[.]org/soft/analytics/extension[.]exe, and another referenced raw.githubusercontent[.]com/gulantin/blanks/main/blanks_online.exe. Mandiant reported financially motivated intrusions involving this methodology in 2023 affecting organizations in semiconductor, business marketing, financial investment, and telecom sectors.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583.008MalvertisingEvidence1

“Rilide is delivered via malicious advertisements or phishing pages.”

Initial Access

1 technique

T1566.002Spearphishing LinkEvidence1

“Rilide is delivered via malicious advertisements or phishing pages.”

Execution

2 techniques

T1059.001PowerShellEvidence1

BRAINLINK is an Advanced Installer compiled dropper which drops a CAB file that contains the RILIDE extension files along with PowerShell scripts to create new shortcuts forcing the execution of RILIDE.

T1059.007JavaScriptEvidence1

If the browsing domain matches one of the monitored domains, the JavaScript in the path value will be accessed and the resulting file injected into the website for execution.

Persistence

2 techniques

T1176Software ExtensionsEvidence1

If the technical sleight of hand is successful, the adversary will achieve persistence by means of malicious Chromium-based browser extensions.

T1547.009Shortcut ModificationEvidence1

The user executes an LNK shortcut file that, unbeknownst to them, has been tampered with. The modified LNK shortcut file executes a legitimate browser, hiding the malicious extension.

Privilege Escalation

1 technique

T1547.009Shortcut ModificationEvidence1

The user executes an LNK shortcut file that, unbeknownst to them, has been tampered with. The modified LNK shortcut file executes a legitimate browser, hiding the malicious extension.

Stealth

1 technique

T1036MasqueradingEvidence1

“Security researchers have observed Rilide impersonating Google Drive and Palo Alto extensions.”

Credential Access

2 techniques

T1056.001KeyloggingEvidence1

“modified to include malicious capabilities such as keylogging” and “content.js file was used to collect information on websites… injected into all URLs before creating the DOM.”

T1555.003Credentials from Web BrowsersEvidence1

“log passwords, and collect credentials for cryptocurrency wallets.”

Collection

2 techniques

T1056.001KeyloggingEvidence1

“modified to include malicious capabilities such as keylogging” and “content.js file was used to collect information on websites… injected into all URLs before creating the DOM.”

T1113Screen CaptureEvidence2

RILIDE is a Chromium-based extension that monitors the URLs visited by victims, screenshots their browser tab views, and injects remote JavaScript into select websites.

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

During initial execution, it fetches a machine identifier and a list of targeted domains from the command and control's (C2) API endpoint /api/machine/init; this list is re-fetched every five minutes.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

pulsedive blogNews

Dec 18, 2025

2025 In Review

Named as an information-stealing browser extension (mentioned as a top blog topic).

pulsedive blogNews

Feb 25, 2025

Compromised Browser Extensions - Jan 2025 | Pulsedive Blog

Information-stealing malware delivered and operating as a malicious Chromium browser extension; steals credentials (including crypto wallet credentials), logs passwords, and takes screenshots. Delivered via malvertising/phishing with a loader that installs the extension; observed impersonating Google Drive and Palo Alto extensions.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Rilide