Chrome extensions hacked, exposing millions of users to data theft risks.
At a Glance
- Over 36 Google Chrome extensions compromised, affecting 2.6 million users
- Attackers used phishing tactics to target extension publishers
- Malicious code inserted into legitimate extensions, bypassing Chrome Web Store security
- User data, including passwords and financial information, at risk
- Incident highlights vulnerabilities in browser extension security
Massive Chrome Extension Hack Puts User Data at Risk
In a startling revelation, cybersecurity experts have uncovered a large-scale attack on Google Chrome extensions, potentially compromising the personal data of millions of users. The breach, which affects at least 36 popular Chrome extensions, has put approximately 2.6 million users at risk of having their sensitive information stolen, including passwords, financial records, and browsing habits.
The attack was first brought to light by cybersecurity firm Cyberhaven after one of its employees fell victim to the scheme. The company released an official statement detailing the incident: “Our team has confirmed a malicious cyberattack that occurred on Christmas Eve, affecting Cyberhaven’s Chrome extension. Public reports suggest this attack was part of a wider campaign to target Chrome extension developers across a wide range of companies.”
🛑 600,000+ users impacted! A widespread campaign compromised 16+ extensions, including tools for AI and VPNs, using phishing and malicious code injection.
Learn more: https://t.co/SZHKeMwBry
— The Hacker News (@TheHackersNews) December 29, 2024
Sophisticated Phishing Campaign Targets Extension Publishers
The attackers employed a sophisticated phishing campaign to target extension publishers listed on the Chrome Web Store. By impersonating Google Chrome Web Store Developer Support, they sent emails urging recipients to click on a link that granted permissions to a malicious OAuth application. This clever tactic allowed the cybercriminals to bypass the Chrome Web Store’s security measures and insert malicious code into legitimate extensions.
“Clicking on the email led the admin to a Google consent screen, requesting permission for an OAuth application named Privacy Policy Extension,” reported ExtensionTotal, adding, “This application was actually a tool controlled by the attacker. By granting permission, the admin unknowingly gave the attacker the ability to upload new versions of Cyberhaven’s Chrome extension to the Web Store.”
The compromised extensions then communicated with an external command-and-control server, downloaded additional files, and began exfiltrating user data. Of particular concern is the targeting of Facebook account data, especially users of Facebook Ads, with attempts made to bypass security measures like two-factor authentication.
Widespread Impact and Ongoing Threat
The scale of this attack is significant, with millions of users potentially affected. While some compromised extensions have been updated or removed from the Chrome Web Store, the threat persists for users who haven’t updated their browsers or removed the affected extensions. Cybersecurity expert Or Eshed warns, “Browser extensions are the soft underbelly of web security. Although we tend to think of browser extensions as harmless, in practice, they are frequently granted extensive permissions to sensitive user information such as cookies, access tokens, identity information, and more.”
“These compromised extensions are exposing over 2.6 million users to data exposure and credential theft, as reported by The Hacker News.”
The incident has also raised questions about the effectiveness of the Chrome Web Store’s security review process. Despite the malicious nature of the uploaded extensions, they were approved for publication after passing the standard security checks. This oversight has left many users vulnerable and highlights the need for more rigorous security measures in the browser extension ecosystem.
Protecting Yourself from Chrome Extension Threats
In light of this breach, users are strongly advised to take immediate action to protect their data. First and foremost, any potentially compromised extensions should be removed immediately. Additionally, users should exercise caution when adding new extensions, carefully reviewing the permissions requested and the developer’s reputation.
To further enhance your online security, consider the following recommendations:
- Verify emails claiming to be from Google or other tech companies
- Use reputable antivirus software
- Limit extension permissions whenever possible
- Keep your browser and all extensions up to date
- Regularly review and remove unnecessary extensions
As our reliance on browser-based tools continues to grow, the threat of such attacks is likely to increase. Vivek Ramachandran, a cybersecurity expert, notes, “Identity attacks targeting browser extensions similar to this OAuth attack will only become more prevalent as employees rely on more browser-based tools to be productive at work.” This incident serves as a stark reminder of the importance of vigilance and proper cybersecurity practices in our increasingly digital world.
