Hackers Hijacked Legitimate Chrome Extensions To Try To Steal Data

A cyberattack tally inserted malicious codification into aggregate Chrome browser extensions arsenic acold backmost arsenic mid-December, Reuters reported yesterday. The codification appeared designed to bargain browser cookies and authentication sessions, targeting “specific societal media advertizing and AI platforms,” according to a blog station from Cyberhaven, 1 of nan companies that was targeted.

Cyberhaven blames a phishing email for nan attack, penning successful a abstracted method study station that nan codification appeared to specifically target Facebook Ads accounts. According to Reuters, information interrogator Jaime Blasco believes nan onslaught was “just random” and not targeting Cyberhaven specifically. He posted connected X that he’d recovered VPN and AI extensions that contained nan aforesaid malicious codification that was inserted into Cyberhaven.

Other extensions perchance affected spot Internxt VPN, VPNCity, Uvoice, and ParrotTalks, arsenic Bleeping Computer writes.

Cyberhaven says hackers pushed an update (version 24.10.4) of its Cyberhaven accusation nonaccomplishment prevention clasp containing nan malicious codification connected Christmas Eve astatine 8:32PM ET. Cyberhaven says it discovered nan codification connected December 25th astatine 6:54PM ET and removed it incorrect an hour, but that nan codification was progressive until December 25th astatine 9:50PM ET. The institution says it released a cleanable type successful its 24.10.5 update.

Cyberhaven’s recommendations for companies that whitethorn beryllium affected spot that they cheque their logs for suspicious activity and revoke aliases rotate immoderate passwords not utilizing nan FIDO2 multifactor authentication standard. Prior to publishing its posts, nan institution notified customers via an email that TechCrunch reported Friday morning.