UnregStealer - Forcelist Extension Registry Hijack

Ibrahim Saud@tektrix

•updated Jun 19, 2026•1•0•3

Detects modifications to Chrome's ExtensionInstallForcelist policy to inject malicious extensions, specifically when initiated by cmd.exe or powershell.exe. This activity is associated with the UnregStealer malware.