Half Million Impacted by Four Malicious Chrome Extensions

itman · Jan 15, 2018

Four malicious Chrome extensions managed to infect over half a million users worldwide, including employees of major organizations, ICEBRG reports.

The extensions were likely used to conduct click fraud and/or search engine optimization (SEO) manipulation, but they could have also been used by threat actors to gain access to corporate networks and user information, the security company warns.

The malicious extensions were discovered after observing an unusual spike in outbound traffic volume from a customer workstation to a European VPS provider, ICEBRG reveals. The HTTP traffic was associated with the domain ‘change-request[.]info’ and was generated from a Chrome extension named Change HTTP Request Header.

While the extension itself does not contain “any overtly malicious code,” the researchers discovered the combination of “two items of concern that” could result in the injection and execution of arbitrary JavaScript code via the extension.
Click to expand...

http://www.securityweek.com/half-million-impacted-four-malicious-chrome-extensions

guest · Jan 16, 2018

Security firm ICEBRG uncovers 4 malicious Chrome extensions
January 16, 2018

The author of the extension could inject and execute arbitrary JavaScript code. [...]
While the researchers did not notice other misbehavior by the extension, capabilities were in place to use it for other means.
Chrome users should verify on chrome://extensions that none of the extensions are installed. It is recommended that you remove these extensions immediately.
Closing Words
Google’s automated system that checks Chrome extensions before they are offered on the Store is severely broken. The last year alone saw a number of incidents where malicious Chrome extensions slipped past Google’s detection routines to infect hundreds of thousands of user systems. (via Bleeping Computer)
Click to expand...

ronjor · Jan 18, 2018

Rogue Chrome, Firefox Extensions Hijack Browsers; Prevent Easy Removal

Jai Vijayan 1/18/2018
"The Chrome extension is a one-of-a-kind so far," says Pieter Arntz, malware intelligence researcher at Malwarebytes. The code that forces the extension to install on a victim's browser itself looks re-used from another family of forced extensions, he says. "But the code to take users away from the extensions list in Chrome, I've never seen before."
Click to expand...

Log in or Sign up

Half Million Impacted by Four Malicious Chrome Extensions

itman Registered Member

guest Guest

ronjor Global Moderator

Log in or Sign up

Half Million Impacted by Four Malicious Chrome Extensions

itman Registered Member

guest Guest

ronjor Global Moderator

Useful Searches