There is an extension named “C2Ext” that I haven’t install it it just pop up in the extension section I can’t delete it I’ve tried to delete the file source and regestry value but it appear again.
That seems very suspicious. Could be malicious – I would highly recommend running a virus scan on your machine. What is the extension ID for this extension?
ID : kglogjegfoalfkbpojlpoegeackplpnb
I have a good antivirus by the way and visit trusted website only.
I also have the same issue, i tried everything, even the kaspersky virus detection tool, it didn’t work. Removing the extension didn’t solve anything as it came back after some time, whether it is rebooting or leaving it for some time. It makes no sense and I can’t find a solution. And this extension is most probably the reason as to why I got hacked multiple times in the past week since I found out that the manifest file in the files of the extension give permission for access to literally everything on my device… so the only real possibility of what this is is that it is spyware, not malware
I don’t think nit-picking the verbiage here is relevant or necessary. Whether spyware or malware, you want it off your system.
If deleting the extension folder from your browsing data folder doesn’t work, removing the extension doesn’t work, and your AV isn’t detecting/finding it, you may need to consider more drastic measures (like reformatting your OS).
I’m going to ask our sec. team to see if anyone has heard of this or knows how to handle this. There surprisingly is not a ton of information I’m seeing on this specific extension.
Go ahead and turn off dev mode and then try deleting the extension data/file again.
i just did it and it came back after i reopened the browser, but i want to note that i deleted the extension and its file without developer mode on before. it came back after i booted my laptop the following day. however, this time, it returned after i closed the browser and opened it again.
A web search of C2Ext bring up this brave community link. So this is something new.
Yeah so this more than likely means that there is some other malware on your machine that is reinstalling the extension. Unfortunately I am not sure where it would be and (as @Ceruledge states) I can’t really find any information on this extension.
At any rate, this does not appear to be a Brave specific issue so I’m not sure how much we can do for you here. As I mentioned at the beginning of this post, if you cannot get rid of the extension by any means and none of the AV apps you’ve tried are finding anything malicious on your machine, I think at this point it’s time to consider reformatting.
Is this only happening in Microsoft versions of windows?
Funnily enough, it does not appear on any other browser I use. The first time I came across the issue was when a popup kept appearing. The popup had a title “C2Ext” and an input box that was already filled with a file location. I went there, discovered it led to an Edge extension file and tried to find the extension on Edge; it wasn’t there. I got confused, so I went to Brave to search about this, and I went to check my extensions on Brave while I was at it. Lo and behold, an unknown extension by the name of “C2Ext” was in my extensions page. Again, this extension does not appear in or migrate to any other browser that I use. It seems to be isolated to this browser.
@RoboKH I’m telling you right now, whatever that is you should not be using this machine until it’s gone. I am quite confident that this has nothing to do with Brave or any specific browser. Some site you were on or file you downloaded contained some malware and it is now on your machine.
There isn’t much I can do here for you other than give you advice, and my advice is to backup whatever you need to back up and reformat your PC.
Already on it, I was just saying how I saw the file acts and where I found it… but I am already in the process of reformatting my laptop right now. Thank you so much for your help and I am sorry if I made things difficult. (Also, sorry for the late response)
Anyone who has had this extension installed should treat the machine as compromised.
More importantly, if you unlocked or used a cryptocurrency wallet while C2Ext was present, assume the wallet’s seed phrase/private keys may have been compromised. .
I encountered this same extension and was able to obtain and analyze its source code. I can confirm that this is malicious. It is not simply a strange or poorly written extension.
This is a cryptocurrency wallet credential and private key stealer with command and control functionality.
The manifest requests extremely powerful permissions, including <all_urls>, debugger, cookies, history, management, scripting, tabs, clipboard access, storage access and system information. It also embeds a unique UUID and the local Chromium profile path.
The background code communicates with the following apparent C2 endpoint:
https://playzarohub.com/extension
It sends information including the victim UUID, browser/version, profile path and installed extensions.
More importantly, the code contains specific modules for identifying cryptocurrency wallet extensions. It uses the Chrome Debugger API to inject JavaScript into wallet extension pages and monitor password inputs, button clicks, form submissions and wallet unlock events.
When a wallet is unlocked, the injected code captures the entered password and reads the wallet extension’s local storage. The malware then contains wallet specific decryption routines that use the captured password to decrypt the stored wallet material.
The resulting data structures explicitly contain:
mnemonic
private_key
password
wallets
accounts
The code then packages successfully decrypted wallet information as extension_creds and periodically POSTs queued results to the C2 server.
I also found the explanation for the strange C2Ext popup several people here have reported. The malware uses JavaScript prompt() calls as an internal communication mechanism. Messages include operations such as attach, detach, dispatch, push_result and pop_results. The popup appears to be this internal IPC mechanism accidentally becoming visible.
That is why the popup contains things like:
[input:<UUID>]
and
{"kind":"pop_results","profile_path":"..."}
I am preserving the extension files and am preparing samples and indicators for submission to the usual suspects in the security space.
Hopefully this saves your security team some time and sufficiently warns anyone else that ends up here. I found this thread by googling the extension name like a few others further up.