Threat intelligence / Malware

TRANSLATEXT

[TRANSLATEXT](https://attack.mitre.org/software/S1201) is malware that is believed to be used by [Kimsuky](https://attack.mitre.org/groups/G0094).(Citation: Zscaler Kimsuky TRANSLATEXT) [TRANSLATEXT](https://attack.mitre.org/software/S1201) masqueraded as a Google Translate extension for Google Chrome, but is actually a collection of four malicious Javascript files that perform defense evasion, information collection and exfiltration.(Citation: Zscaler Kimsuky TRANSLATEXT)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[TRANSLATEXT](https://attack.mitre.org/software/S1201) is malware that is believed to be used by [Kimsuky](https://attack.mitre.org/groups/G0094).(Citation: Zscaler Kimsuky TRANSLATEXT) [TRANSLATEXT](https://attack.mitre.org/software/S1201) masqueraded as a Google Translate extension for Google Chrome, but is actually a collection of four malicious Javascript files that perform defense evasion, information collection and exfiltration.(Citation: Zscaler Kimsuky TRANSLATEXT)

Labels

malware

16 recorded

Relationships

uses

Group

uses

to Bidirectional Communication

Technique

uses

to Browser Extensions

Technique

uses

to Browser Session Hijacking

Technique

uses

to Credentials from Web Browsers

Technique

uses

to Dead Drop Resolver

Technique

uses

to Email Collection

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Modify Registry

Technique

uses

Technique

uses

to Query Registry

Technique

uses

to Screen Capture

Technique

uses

to Steal Web Session Cookie

Technique

uses

to Traffic Signaling

Technique

uses

to Web Protocols

Technique

2 external

References

mitre-attack

S1201

Zscaler Kimsuky TRANSLATEXT

https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis