Opera GX silent Mod install via rapid .crx download to manifest.json extraction
Detects the silent installation of Opera GX mods by correlating the rapid arrival of a .crx file followed by the creation of a manifest.json file within the Opera GX mods profile directory. This pattern indicates potential exploitation of the silent installation pipeline where an extension is added without explicit user confirmation prompts.
Microsoft Sentinel (KQL)
