browser-chrome-extension[.]framer[.]media

This domain, browser-chrome-extension.framer.media, poses as a legitimate Chrome extension download portal but is designed to distribute malicious browser add-ons. These fake extensions typically harvest login credentials, inject unauthorized scripts into web sessions, or redirect users to additional phishing infrastructure. The site mimics legitimate software distribution pages, often using social engineering tactics such as fake update prompts or urgency-based messaging to trick users into installing the malicious payload. Given its association with browser extensions, the threat extends beyond immediate credential theft, potentially enabling persistent access to victims' browsing activity and sensitive data. Analysis indicates this domain was registered through CSC Corporate Domains, Inc. on February 21, 2026, an unusually future-dated creation that may suggest domain squatting or preparation for a future campaign. The domain is flagged by 19 out of 95 security vendors on VirusTotal, including detections for phishing and malicious content. It appears on two security blocklists (PhishDestroy and PhishingDB) and is explicitly flagged by Google Safe Browsing as phishing. Infrastructure analysis reveals the domain resolved to IP address 35.71.142.77, hosted on Amazon Web Services (AS16509), a common platform for both legitimate services and malicious operations due to its scalability and low-cost hosting options. The SSL certificate, issued by Let's Encrypt (serial number E7), provides encryption but does not validate the legitimacy of the site's content. If you visited browser-chrome-extension.framer.media or installed any software from it, take immediate action to mitigate potential compromise. First, uninstall any browser extensions added during the suspected timeframe, particularly those claiming to be related to Chrome or Framer. Run a full system scan using updated antivirus software to detect and remove any associated malware. Reset all passwords for accounts accessed during the period, prioritizing email, financial, and work-related credentials. Enable multi-factor authentication where available to add an additional layer of security. Monitor accounts for unauthorized activity, such as unfamiliar logins or transactions. If the extension was installed in a corporate environment, report the incident to your IT security team to assess potential lateral movement or data exfiltration risks. Finally, check browser settings for unauthorized changes, such as altered default search engines or unexpected homepage configurations.