Chrome Extension Chaos: 600,000 Users at Risk as Sneaky Hackers Steal the Show
Browser extensions are the soft underbelly of web security, says LayerX Security’s CEO. A new attack campaign compromised at least 16 Chrome browser extensions, exposing over 600,000 users to data theft. The breach began with a phishing attack on publishers, injecting malicious code to steal cookies and user access tokens.
Hot Take:
Turns out, those cute little browser extensions we all love might just be the cyber equivalent of a Trojan horse. Who knew that your AI chat buddy might be moonlighting as a data thief? It’s like finding out your friendly neighborhood barista is also a spy. Time to audit those extensions, folks!
Key Points:
- Over 16 Chrome browser extensions were compromised, affecting more than 600,000 users.
- Attackers used phishing to infiltrate and modify legitimate extensions with malicious code.
- Cyberhaven was the first company to report a breach, revealing communication with a rogue C&C server.
- Compromised extensions include popular AI and VPN tools, among others.
- Even if extensions are removed from the store, they can still pose a risk if installed on endpoints.
Already a member? Log in here