Malicious Chrome Extensions Attack: How Hackers Stole User Data at Scale 

Briefly: Hackers used to steal user data by publishing numerous fake extensions in the Chrome Web Store.

What is this Malicious Chrome extension attack?

Researchers found out that 108 Chrome extensions were involved in a well-coordinated hacking campaign. They were published under the names of different developers, but in practice, they were all directed by the same hacking group. Between 20,000 and 30,000 individuals were unwilling victims of this attack because they downloaded these extensions.

That is, it seemed that there were numerous individual apps on the surface, but in reality, it was being run by one gang.

What was the way this attack was carried out?

All these extensions seemed to be regular and rather useful, like Telegram tools, extensions that are aimed at improving the user experience on YouTube or TikTok, translators, or even just a game. As a result, the majority of users did not suspect anything; each of them was sure that they were safe.

So what were these extensions doing?

1. Google Account Data Theft: A Google account is stolen and then used to log into a personal account of the victim. 54 of the extensions leaked full Google account identity information- emails, profile information, and IDs. They were able to have direct access to this data, using OAuth tokens.

Even after the user changes his password, a hacked Google ID implies that he or she can still be tracked. This is just what makes this threat very dangerous.

2. Telegram Account Hacking: All of the running Telegram sessions were hijacked every 15 seconds. This implied that the hacker was not required to type a password to access the full usage of your account, and with ease, your chats, contacts, and all other personal information were in their hands. 

3. Placing Browser Backdoors: The presence of hidden backdoors was identified in about 45 extensions. The hacker used to seize control of the browser whenever the browser was opened, enabling them to access any website of their choice. This was an ongoing assault-that is, they had constant access.

4. Injection of Ads on all websites: The attackers went around security systems of large platforms such as YouTube and TikTok to inject gambling advertisements and arbitrary scripts. This not only earns profits for the hackers but also helps them to spread other malware. 

5. Control of Your Web History: All of the sites you searched and all of the sites you accessed were being monitored and sent to a server controlled by a hacker.

What was the riskiest part of this attack?

The extensions were all connected to one Command-and-Control server. This was indicative of a coordinated group of hackers, the unity of a system, and surveillance on a massive scale.

What makes this attack so serious?

The easy way out is this: they were all happening on the Chrome Web Store. This means that the security measures of Google were compromised, and a platform that is usually deemed to be secure had been infected by malware. It created the illusion of being secure because users believed that, because they had installed extensions via the Chrome Store, they were automatically secure.

What is the caution that this sends to users and businesses?

It is not just a generic warning; it is an expression of a very serious trend that needs to be considered: hackers are no longer attacking individual applications individually, but rather, they are changing the focus of their attacks to browser extensions. Moreover, they are capitalising on the innate trust attributed to official app stores. Users are totally oblivious to these activities- everything is done in the background without the user knowing that. 

What is necessary for advanced-level protection?

In today’s landscape, attacks have become quite tricky; basic protection alone is no longer sufficient. You must always stay one step ahead.

Continuous Monitoring: You must monitor closely what is going on in the system in real-time. Record all the undercover operations as they happen, and you can avoid the possibility of missing important things that fall through the cracks.

Device-Level Protection: Fastly identify and block suspicious traffic on each device. Otherwise, it may result in one or more compromised endpoints becoming the point of entry to an attack on the whole system.

Secure Backup Strategy: Information can be compromised at any time, and thus, a solid backup should always be available. Recovery should be a hassle-free process.

And lastly – Risk Assessment and Audit. You should be aware of your position, the vulnerability, or the security. How can you possibly take care of the risks involved when you do not really know about your own posture?