Check Your Chrome Extensions: 33 Are Stealing Data

Over the holiday season, while everyone was celebrating, a group of researchers discovered that 33 Chrome extensions in Google's Web Store had been stealing data for up to 18 months. These extensions affected around 2. 6 million devices. One such extension, used by 400, 000 people, was updated with malicious code. This code, available for just 31 hours over Christmas, automatically downloaded and installed on active browsers. The extension was meant to protect users from leaking sensitive data into emails or websites.

The malicious version was distributed through a spear-phishing email sent on Christmas Eve. This email warned about policy violations, tricking the developers into updating the extension with harmful code. The compromised version downloaded payloads from a fake website, cyberhavenext

Actions