Hackers Take Over Chrome Extensions To Steal User Information

On Christmas Eve, data protection company Cyberhaven was hit by a cyberattack targeting its Google Chrome extension. Hackers uploaded a malicious version of the extension to the Chrome Web Store, which let it steal sensitive user information. Security researchers believe this breach was part of a broader campaign aimed at multiple Chrome extension developers.

Cyberhaven disclosed the incident in a December 27 blog post. “Our team has confirmed a malicious cyberattack that occurred on Christmas Eve, affecting Cyberhaven’s Chrome extension,” wrote Howard Ting, Cyberhaven’s CEO. “Public reports suggest this attack was part of a wider campaign to target Chrome extension developers across a wide range of companies.”

According to the browser extension security platform Secure Annex, other compromised extensions include VPNCity, Uvoice, and Search Copilot AI Assistant for Chrome. You can view an updated spreadsheet of these extensions here.

Preliminary findings indicate the attackers gained access when one of Cyberhaven’s employees fell for a phishing scheme. Phishing relies on fraudulent emails or messages to trick people into sharing login credentials. In this case, hackers posed as Chrome’s developer support, sending emails that led developers to a deceptive app called “Privacy Policy Extension.” Once developers signed in, hackers accessed the Chrome Web Store and uploaded a malicious version of the extension.

The hackers designed the code to steal Facebook access tokens, user IDs, and information about accounts, businesses, and ads from users who had the compromised extensions installed. They also recorded mouse clicks on Facebook, presumably to bypass captchas and two-factor authentication.

Although Cyberhaven and other affected companies removed the malicious versions of their extensions, experts warn that not all compromised extensions may have been identified or fixed. Some still appear to remain active, leaving users vulnerable.

The attack came at the tail end of a year fraught with data leaks and threats to data protection worldwide, including the biggest password leak in history last July. To minimize the risk of exposure to future cyberattacks, experts urge users to monitor app updates, carefully read developer messages, and verify any requests for login credentials.