Hackers Deploy Malicious Chrome Extensions

Uploaded on 2025-01-03 in TECHNOLOGY--Hackers, NEWS-Cybersecurity News, FREE TO VIEW, BUSINESS-Services-IT & Telecoms

A large-scale hacking campaign targeting Chrome extensions has compromised at least 25 extensions, potentially impacting over two million users worldwide, including the cybersecurity firm Cyberhaven, which first detected the attack over the Christmas. They successfully removed the malicious package from the Chrome Web Store within 60 minutes of detection, although numerous Cyberhaven customers were also affected.

In an email to customers, Cyberhaven says hackers published a malicious update to its Chrome extension that was capable of stealing customer passwords and session tokens. The compnay's website lists several major clients, including Canon, Motorola and Reddit.

The browser extension is Cyberhaven’s primary tool for monitoring and blocking data exfiltration. It tracks data sent via emails, AI tools and web applications. Browsers running the compromised extension were vulnerable to abuse for over 30 hours and the attackers could potentially exfiltrate victims’ sensitive information, including authenticated sessions and cookies, according to Cyberhaven.

The attack is understood to have involved only machines running Chrome-based browsers that were updated via the Google Chrome Web Store.

Researchers outside the company have suggested that the administrator’s account was likely compromised through a phishing email, although it remains unclear how many organisations were affected by the attack or what the hackers’ aimed to achieve.

Security analysts said that additional extensions could have been compromised using similar malicious code. They identified over a dozen suspicious domains linked to the attackers' infrastructure.

Cyberhaven say that heir investigation is continuing, with the assistance of Google-owned cyber security firm Mandiant.

The company recommends that its customers update the extension, rotate passwords and tokens, clear sessions and review logs for any suspicious activity. It has advised users not to remove the extension, in order to preserve the malicious code for analysis.

@vxunderground | Economic Times | Techcrunch

Image:

You Might Also Read:

Highly Evasive Adaptive Threats & Advanced Persistent Threats:

If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.