Chrome browser extensions hijacked

By

Attacker inserts adware code.

Developers of extensions for Google's Chrome web browser are being targeted by an unknown attacker, who has succesfully hacked their accounts and subverted their add-on code for malicious purposes.

Chrome browser extensions hijacked

After a developer reported that his extension had been compromised, security vendor Proofpoint found evidence that further add-ons in the Chrome Store had also been altered.

The list of compromised extensions so far include:

  • Web Developer 0.4.9
  • Chrometana 1.1.3
  • Infinitely New Tab 3.12.3
  • CopyFish 2.8.5
  • Web Paint 1.2.1
  • Social Fixer 20.1.1

In June, TouchVPN and BetternetVPN were also compromised, Proofpoint researcher Kafeine said.

The attacker obtains access to developer accounts by sending out phishing emails with booby-trapped links that ask the coders to log into their Google Chrome Web Store dashboards.

Once the attacker has access to an account, they add Javascript code to the add-ons to hijack traffic and to substitute advertisements in users' browsers, in order to earn revenue via affiliate programs.

In one instance, the developers of the Copyfish extension fell for the phishing attempt, and didn't discover the compromise for a whole day. 

At this stage, it is not known who is behind the multiple hijackings of Chrome extensions.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © iTnews.com.au . All rights reserved.
Tags:

Most Read Articles

Phishing attack nets enormous npm supply chain compromise

Phishing attack nets enormous npm supply chain compromise

Service NSW centralises security, networking in mammoth CloudOps overhaul

Service NSW centralises security, networking in mammoth CloudOps overhaul

VicRoads to phase out passwords in favour of passkeys

VicRoads to phase out passwords in favour of passkeys

Apple adds "mercenary spyware" protection to new A19 chip

Apple adds "mercenary spyware" protection to new A19 chip

Log In

  |  Forgot your password?