Phishy Business: Chrome Extensions Under Attack – How Cyberhaven Got Hooked
Cyberhaven’s Christmas Eve turned into a chaotic sleigh ride when a phishing attack targeted their Chrome extension, a reminder that supply chain security isn’t just for holiday gifts. With 36 extensions and 2.6 million users affected, it’s time to unwrap the issues of Chrome extension vulnerabilities and get serious about security.
Hot Take:
Ah, the holiday spirit! Nothing says ‘Merry Christmas’ like a cybercriminal sneaking down your digital chimney to steal your cookies! Cyberhaven’s developers probably wished they had asked Santa for a better email filter instead of those socks.
Key Points:
- A phishing email masquerading as a Google communication led to a security breach at Cyberhaven.
- The attack targeted Chrome extensions to exfiltrate data and potentially bypass captchas.
- 36 different Chrome extensions affecting up to 2.6 million users have been linked to the attack.
- Modern shadow IT practices leave companies vulnerable to supply-chain attacks through SaaS applications.
- Developers are urged to adopt better security practices and monitoring for their browser extensions.
Already a member? Log in here