New Google Chrome Drive-By Hack Attack—Users Must Act Now

Forbes - Feb 9th, 2025
Open on Forbes

The ValleyRAT malware campaign has emerged as a significant threat by employing sophisticated drive-by download strategies targeting users seeking to download the Google Chrome browser app. Shmuel Uzan from Morphisec Threat Labs highlighted that attackers are using phishing emails, malicious websites, and instant messaging platforms to trick users into downloading the malware. The campaign is particularly targeting finance, sales, and accounting professionals due to their access to sensitive data, moving away from the broader 'spray and pray' tactics of previous attacks. Erich Kron from KnowBe4 emphasized the importance of downloading software from official sites to avoid malicious downloads masquerading as legitimate software.

This development comes amid a series of security issues surrounding Google Chrome and the ChromeOS operating system. Google has been active in addressing various vulnerabilities, including a critical Linux zero-day for Android users and a security update for Gmail. However, the ongoing threat of ValleyRAT highlights the persistent risks facing users of the world's most popular web browser. With over three billion users globally, ensuring software is downloaded securely and staying updated with the latest security patches is crucial to mitigate these threats. Cybersecurity experts warn that the tactics used in this campaign could be replicated for attacks on Western companies, urging vigilance among professionals handling high-value data.

Story submitted by Fairstory

RATING

7.2
Fair Story
Consider it well-founded

The article provides a comprehensive overview of the ValleyRAT malware threat, highlighting its sophistication and the specific targeting of high-value individuals in finance and accounting sectors. The inclusion of expert opinions and recent developments adds depth to the discussion, making it timely and relevant. However, the article could improve its accuracy by providing more direct citations and confirmations of specific claims, such as the impersonation of a Chinese telecom company.

While the article maintains a generally balanced perspective, it could benefit from including more viewpoints from affected users or organizations and providing Google's perspective on the ValleyRAT threat. The source quality is strong, with credible cybersecurity experts cited, but direct responses from affected parties would enhance the article's credibility.

The article is mostly clear and readable, but some improvements in structure and explanation of technical terms would enhance comprehension. Its potential impact on public awareness and behavior is moderate, with room for greater influence if accompanied by actionable advice. Overall, the article effectively addresses a topic of significant public interest, providing valuable information to enhance cybersecurity awareness, but could benefit from more transparency and engagement elements to maximize its impact and readability.

RATING DETAILS

8
Accuracy

The article presents a detailed account of the ValleyRAT malware threat, employing a drive-by download strategy targeting Google Chrome users. The factual accuracy is supported by specific claims, such as the malware's sophistication and its targeting of finance, sales, and accounting professionals. These claims align with known reports from cybersecurity sources like Morphisec Threat Labs. The article also correctly identifies the methods used by attackers, such as phishing emails and malicious websites, which are standard tactics in cyber threats.

However, while the article accurately describes the general nature of the threat, some details require further verification. For example, the impersonation of a Chinese telecom company named Karlos is a specific claim that needs direct confirmation from cited sources. Additionally, the article mentions that the threat is primarily aimed at Chinese users, which would benefit from more explicit evidence or statements from cybersecurity experts. Overall, the article is mostly accurate but would benefit from more direct citations and confirmations of specific claims.

7
Balance

The article maintains a generally balanced perspective, highlighting both the threat posed by ValleyRAT and the recent security improvements by Google. It provides viewpoints from multiple cybersecurity experts, offering a range of opinions on the severity and implications of the threat. This inclusion of expert insights helps to present a well-rounded picture of the issue.

However, the article could improve by including more perspectives from affected users or organizations, especially those within the targeted sectors, such as finance and accounting. Additionally, while it mentions Google's response to other security vulnerabilities, it does not provide Google's perspective or response to the ValleyRAT threat itself, which could offer a more comprehensive view of the situation.

7
Clarity

The article is generally clear and concise, with a logical flow that guides the reader through the key points of the ValleyRAT threat. The language is straightforward, making it accessible to a general audience, even those without a technical background in cybersecurity.

However, some sections could benefit from clearer explanations, particularly regarding technical terms like 'drive-by download' and 'phishing emails.' Providing brief definitions or examples would help readers unfamiliar with these concepts better understand the content. Additionally, the article could improve its clarity by organizing information into more distinct sections, such as separating the discussion of the threat from the mitigation strategies. Overall, while the article is mostly clear, some improvements in structure and explanation would enhance comprehension.

8
Source quality

The article cites credible sources, including cybersecurity experts from Morphisec Threat Labs and CyberSmart, which adds to its reliability. These sources are well-regarded in the field of cybersecurity and provide authoritative insights into the nature and implications of the ValleyRAT threat.

However, the article could enhance its source quality by directly quoting or referencing statements from Google regarding the specific threat of ValleyRAT. Including official statements or responses from the company would strengthen the article's credibility and provide a more balanced view of the issue. Overall, the use of expert sources is strong, but the inclusion of direct responses from affected parties would improve the source quality.

6
Transparency

The article provides some context about the ValleyRAT threat and the methods employed by the attackers, which helps readers understand the situation. The inclusion of expert opinions adds depth to the analysis, offering insights into the potential risks and implications of the malware.

However, the article lacks transparency in terms of the methodology used to gather information. It does not clearly explain how the data was obtained or the specific sources of certain claims, such as the impersonation of a Chinese telecom company. Additionally, the article does not disclose any potential conflicts of interest, such as affiliations between the experts quoted and the organizations involved. Greater transparency in these areas would enhance the article's credibility and help readers better assess the reliability of the information presented.

Sources

  1. https://thehackernews.com/2025/02/fake-google-chrome-sites-distribute.html
  2. https://www.morphisec.com/blog/rat-race-valleyrat-malware-china/
  3. https://www.bankinfosecurity.com/hackers-launch-supply-chain-attack-against-chrome-extensions-a-27173
  4. https://hackread.com/valleyrat-malware-variant-fake-chrome-downloads/
  5. https://www.trendmicro.com/vinfo/us/security/definition/drive-by-download