Sunday, April 20, 2025
HomeHacksSeven More Chrome Extensions compromised to hijack traffic and substitute advertisements on...

Seven More Chrome Extensions compromised to hijack traffic and substitute advertisements on users browsers

Published on

SIEM as a Service

Follow Us on Google News

Chrome Extensions continue to get compromised, the initial compromise on Aug1, attackers used Copyfish extension to spread spam. Now add to the list another seven extensions has been compromised.

Attackers using phishing methods to steal account credentials of Author’s which results in hijacking traffic and exposing users to fake popups and password theft.

Proofpoint published a report that shows more extensions has been hijacked Web Developer 0.4.9” extension compromise, but found evidence that “Chrometana 1.1.3”, “Infinity New Tab 3.12.3” [8][10] , “CopyFish 2.8.5” [9], “Web Paint 1.2.1” [11], and “Social Fixer 20.1.1” [12]. They do believe TouchVPN and Betternet VPN also compromised.

According to their Proofpoint analysis, the compromised extension will check for the chrome extension for 10 minutes and then it uses to retrieve remote file ga.js over HTTPS secure connection.

- Advertisement - Google News

Compromised version of the extension attempts to substitute ads on the victim’s browser, hijacking traffic from legitimate advertising networks.

Also read Google Fixes 26 High-Severity Flaws In Chrome Browser – Google Paid 70000$ to External Researchers

Compromised version of the extension attempts to substitute ads on the victim’s browser, hijacking traffic from legitimate advertising networks.

Chrome extension
Source: Proofpoint

For ad units, attackers created well-crafted substitutions to hide adult websites.

Also, they use to generate a fake Java Script alert and then some affiliate programs receiving the Hijacked traffic.

Chrome extensions
Source: Proofpoint

An examination of the affiliate landing pages (program update[.]info, program update[.]info and searchtab[.]win) demonstrated that activity was “considerable.” According to Proofpoint, searchtab[.]win got 920,000 visits in one month. It’s vague the amount of that activity was created through the hijacked Chrome Extensions.

Chrome extensions
Source: Proofpoint
In addition to hijacking traffic and driving users to questionable affiliate programs, we have also observed them gathering and exfiltrating Cloudflare credentials, providing the actors with new means of potential future attacks. Says researchers from Proofpoint.

Also read Sophisticated Backdoor Called “Stantinko” Infected More Than 500,000 Computers

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

10 Best Patch Management Tools 2025

In today's digital landscape, maintaining secure and efficient IT systems is critical for organizations....

10 Best Cloud Security Solutions 2025

In today’s digital era, businesses are increasingly adopting cloud computing to store data, run...

Chinese Hackers Exploit Ivanti Connect Secure Flaw to Gain Unauthorized Access

In a sophisticated cyber-espionage operation, a group known as UNC5221, suspected to have China-nexus,...

New Android SuperCard X Malware Uses NFC-Relay Technique for POS & ATM Transactions

A new malware strain known as SuperCard X has emerged, utilizing an innovative Near-Field...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Gain Legends International Suffers Security Breach – Customers Data Stolen

Gain Legends International, a prominent name in sports, entertainment, and venue management, has confirmed...

Over 17,000 Fortinet Devices Hacked Using Symbolic Link Exploit

A major cyberattack has compromised more than 17,000 Fortinet devices globally, exploiting a sophisticated...

Hacktivist Group Becomes More Sophisticated, Targets Critical Infrastructure to Deploy Ransomware

A recent report by Cyble has shed light on the evolving tactics of hacktivist...