Chrome Web Store extensions caught stealing crypto, browser data
-
Security researchers have uncovered a malicious campaign targeting users of Google Chrome and Microsoft Edge through extensions distributed on their official stores. The operation delivered a modular malware framework capable of exfiltrating cryptocurrency, sensitive user data, and browsing history, while also injecting ClickFix social engineering lures into web sessions.
The extension set acted as a delivery mechanism for a multi-stage payload. Once installed, the framework deployed individual modules designed to perform specific malicious tasks, including credential harvesting and crypto wallet draining. The ClickFix injection technique presents users with fake error prompts that trick them into copying and running malicious commands, which can lead to further system compromise.
Key details from the investigation include:
- Malicious extensions were available on both the Chrome Web Store and Microsoft Edge Add-ons store, bypassing initial security reviews.
- The framework's modules targeted browser history, cookies, and cryptocurrency wallet data.
- ClickFix lures were injected into legitimate web pages to trick users into executing PowerShell commands or other harmful scripts.
- The campaign appears to be ongoing, with new extensions potentially added over time.
Users who installed any suspicious extensions should immediately remove them, revoke permissions granted to those extensions, and check for unauthorized transactions in their crypto wallets. Additionally, clearing browser cache and cookies, and resetting any credentials stored in the browser, is strongly recommended.
Source: BleepingComputer
Do you have visibility into your organization's approved browser extension list, and how do you enforce it against store-hosted threats?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login