At least five Chrome extensions were compromised in a coordinated attack where a threat actor injected code that steals sensitive information from users.
One attack was disclosed by Cyberhaven, a data loss prevention company that alerted its customers of a breach on December 24 after a successful phishing attack on an administrator account for the Google Chrome store.
Among Cyberhaven's customers are Snowflake, Motorola, Canon, Reddit, AmeriHealth, Cooley, IVP, Navan, DBS, Upstart, and Kirkland & Ellis.
The hacker hijacked the employee’s account and published a malicious version (24.10.4) of the Cyberhaven extension, which included code that could exfiltrate authenticated sessions and cookies to the attacker's domain (cyberhavenext[.]pro).
Cyberhaven's internal security team removed the malicious package within an hour since its detection, the company says in an email to its customers.
A clean version of the extension, v24.10.5 was published on December 26. Apart from upgrading to the latest version, users of the Cyberhaven Chrome extension are recommended to revoke passwords that aren’t FIDOv2, rotate all API tokens, and review browser logs to evaluate malicious activity.
More Chrome extensions breached
Following Cyberhaven's disclosure, Nudge Security researcher Jaime Blasco took the investigation further, pivoting from the attacker’s IP addresses and registered domains.
According to Blasco, the malicious code snippet that let the extension receive commands from the attacker was also injected around the same time in other Chrome extensions:
- Internxt VPN – Free, encrypted, unlimited VPN for secure browsing. (10,000 users)
- VPNCity – Privacy-focused VPN with AES 256-bit encryption and global server coverage. (50,000 users)
- Uvoice – Rewards-based service for earning points through surveys and providing PC usage data. (40,000 users)
- ParrotTalks – Information search tool specializing in text and seamless note-taking. (40,000 users)
Blasco found more domains that point to other potential victims but only the extensions above were confirmed to carry the malicious code snippet.
Users of these extensions are recommended to either remove them from the browser or upgrade to a safe version published after December 26 after making sure that the publisher has learned about the security issue and fixed it.
If unsure, it would be better to uninstall the extension, reset important account passwords, clear browser data, and reset browser settings to their original defaults.
Related Articles:
Fake Bitwarden ads on Facebook push info-stealing Chrome extension
OpenAI's new ChatGPT Search Chrome extension feels like a search hijacker
LastPass warns of fake support centers trying to steal customer data
Over a thousand online shops hacked to show fake product listings
New FlowerStorm Microsoft phishing service fills void left by Rockstar2FA
Original Article Published at Bleeping Computer
________________________________________________________________________________________________________________________________