- Researchers discover major supply chain attacks targeting Chrome extension developers
- Dozens have been compromised, resulting in possibly millions of victim users
- Researchers encourage users to patch or uninstall certain extensions
Hackers have managed to compromise dozens of legitimate Google Chrome extensions in what appears to be a highly sophisticated supply chain attack.
As a result, millions of browser users are at risk of data theft, identity theft, Internet fraud and more, cybersecurity researchers at Sekoia have said.
The researchers said the attack starts with a very convincing phishing attack, where the threat actors impersonated Google Chrome Web Store support. They sent emails to Chrome extension developers, warning them of violated store policies and having their work removed from the store unless they “expanded their privacy policy.” Naturally, the email came with a link leading to a legitimate Google OAuth authentication page built for a malicious application
Facebook Business and other goals
Victims who would log in would actually share their login credentials with the attackers, who would use the access to poison their work and compromise the extensions.
Sekoia says the threat actors went after Facebook Business accounts, API keys, session cookies, access tokens, account information and ad account details. In some cases, it added, the crooks also went after ChatGPT API keys and user authentication data.
The team traced the campaign back to at least March 2024, with the possibility of earlier activity as well.
Some of the more popular extensions that were targeted include GraphQL Network Inspector, Proxy SwitchyOmega (V3), YesCaptcha Assistant, Castorus and VidHelper – Video Download Helper. The full list of affected extensions can be found at this link.
The number of affected individuals is measured in the hundreds of thousands, or even millions, and mostly revolves around the number of downloads of these plugins. Most of the poisoned solutions have already been downloaded from the Chrome Webshop. However, users are still advised to remove or update affected extensions to versions released after December 26, 2024 and reset important account passwords, especially for Facebook and ChatGPT.
Via The register
