Busted: Huge malware operation targeted Google Chrome extensions

guest · Feb 14, 2020

Busted: Huge malware operation targeted Google Chrome extensions
February 14, 2020
https://bgr.com/2020/02/14/google-chrome-extensions-more-than-500-removed-malware-operation/

[...] security researcher Jamila Kaya stumbled across the first in a series of malicious Google Chrome extensions that would spark a two-month investigation and lead to the removal of more than 500 extensions by Google from its web store.

Unfortunately, more than 1.7 million Chrome users had already installed that first batch of extensions she found, which gave some urgency to this investigation — the results of which have been unveiled in a newly published report into what turned out to be a huge malware operation active for at least two years.

After her initial discovery, Kaya reached out to the Duo security team at Cisco, according to the report. She contacted them about a variety of Chrome extensions she found that infected browsers and would “exfiltrate data as part of a larger campaign.”
Click to expand...

The Duo team goes on to explain that bad actors are increasingly using legitimate internet activity to obscure their malicious actions, one of the most popular channels being the use of advertising cookies and the redirects within them. It’s a technique called “malvertising” that is surprisingly hard to detect.

“Malvertising often occurs within other programs, acting as a vehicle for multiple forms of fraudulent activity, including ad-fraud, data exfiltration, phishing, and monitoring and exploitation,” the report continues.
The code within these malicious extensions would sometimes redirect users to an affiliate link on sites like Best Buy’s or Macy’s. Other times, the destination might be a download site for malware.
Click to expand...

Duo: Security Researchers Partner With Chrome To Take Down Browser Extension Fraud Network Affecting Millions of Users

Cisco’s Duo Security released CRXcavator, our automated Chrome extension security assessment tool, for free last year in order to reduce the risk that Chrome extensions present to organizations and to enable others to build on our research to create a safer Chrome extension ecosystem for all.

In a perfect example of the research we hoped to facilitate, security researcher Jamila Kaya (@bumblebreaches) used CRXcavator to uncover a large scale campaign of copycat Chrome extensions that infected users and exfiltrated data through malvertising while attempting to evade fraud detection on the Google Chrome Web Store. Duo, Jamila, and Google worked together to ensure these extensions, and others like them, were promptly found and removed.
Click to expand...

Log in or Sign up

Busted: Huge malware operation targeted Google Chrome extensions

guest Guest

Log in or Sign up

Busted: Huge malware operation targeted Google Chrome extensions

guest Guest

Useful Searches