# Data Exfiltration via Chrome Extension

## Context:
In the final stage of their operation, Kimsuky actors focus on exfiltrating valuable data using malicious Chrome extensions.

## How It Works:
- **Email Theft**: The malware utilizes a rogue Chrome extension to capture and exfiltrate email data directly from the victim's browser.
- **Covert Operations**: This method allows the attackers to bypass traditional network defenses, as the data theft occurs directly within the browser environment.

Regular audits of installed browser extensions and monitoring for unusual data transfer activities are crucial to detecting such exfiltration attempts.