Threat actors backed by North Korea have been operating an information stealing browser extension for about a year, harvesting personal user information from victims’ Chrome, Edge, or Whale browsers. The threat group, tracked as Kimsuky and Thallium, is a nation-state organization that has been active since 2012 and primarily focuses on cyberespionage campaigns. Kimsuky has targeted several major countries including South Korea, United States, Russia, and European nations. The group often conducts their malicious acts to gain further intelligence on security issues tied to the Korean region, nuclear policy, and ever-growing sanctions. In this nearly year-long campaign, Kimsuky has been utilizing this malicious extension (dubbed SHARPEXT) as its persistence method after initially compromising the victim’s device. SHARPEXT has the capabilities to parse and harvest information from emails in Gmail and AOL inboxes as well as send requests to download additional emails from a web page. Since the extension does not physically attempt to sign into the users email account, security alerts are not tripped, and the user is not notified of any compromise. While malicious browser extensions have been a part of the threat landscape for a long time, their use as a persistence mechanism is relatively new and has the potential of being more commonly utilized in the future by threat organizations globally. CTIX continues to monitor threat actors worldwide and will provide additional updates accordingly.