Thursday, March 28, 2024

Four Malicious Chrome Extensions Impacted More than Half a Million Users

Security researchers from Cybersecurity firm ICEBRG detected four malicious chrome extensions that impacted more than half a million people.

The initial investigation started after they noticed an unusual traffic flow in one of their client workstation, it appears like attackers use the extensions to conduct click fraud for generating more revenue or for SEO purpose.

Four Malicious Chrome Extensions

Change HTTP Request Header

Researchers identified the HTTP traffic is to the domain change-request[dot]info from the malicious chrome extension “Change HTTP Request Header”. And the control server at change-request[dot]info returns obfuscated Javascript.

The Javascript creates a WebSocket tunnel with change-request[dot]info control server and the WebSocket to proxy victim browser traffic. Attackers utilized it for running a click fraud ad campaign. ICEBRG published a detailed report on extension behaviors.

Malicious Chrome Extensions

Nyoogle – Custom Logo for Google and Lite Bookmarks

Like Change HTTP Request Header, Nyoogle and Lite Bookmarks utilize a similar mix of allowing ‘unsafe-eval’ through the CSP with periodical configuration

Stickies – Chrome’s Post-it Notes

It also enables the ‘unsafe-eval’ via the CSP but uses obfuscation methods to retrieve the external javascript.

Chrome Extensions continue to get compromised, the initial compromise on Aug1, attackers used Copyfish extension to spread spam. Malware files have a size far beyond the ordinary and far beyond what is usually inspected for anti-virus solutions.

Now even the Chrome extension started mining cryptocurrency, a chrome extension Archive Poster with more than 105,000 users Caught injecting an in-browser cryptocurrency miner.

Chrome announced site isolation with Chrome 63 which allows each website to have a dedicated process isolated from other sites, allows to Whitelist or Blacklist specific extensions.

Website

Latest articles

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles