How secure are your browser extensions? 
A recent attack campaign has compromised at least 16 Chrome browser extensions, potentially exposing over 600,000 users to credential theft and data breaches. The attack exploited the extensive permissions granted to these extensions, demonstrating how they can be a weak link in web security systems.
The breach was initiated through a phishing scheme targeting extension publishers on the Chrome Web Store. Once attackers gained access, they implanted malicious code into legitimate extensions, enabling them to steal cookies, user access tokens, and other sensitive data. This malicious code communicated with an external Command and Control (C&C) server, allowing hackers to download additional configurations and exfiltrate stolen data.
Cybersecurity firm Cyberhaven was one of the first known victims. Its browser extension was compromised, and its malicious version remained active for about 24 hours before being removed. However, security experts warn that removing the extension from the Chrome Web Store doesn't entirely resolve the threat. If the compromised extension remains installed on user devices, it could still exfiltrate data.
The attack was not isolated to Cyberhaven. Security researchers identified several other compromised extensions during their investigation, including popular tools like AI Assistant - ChatGPT and Gemini for Chrome, Bard AI Chat Extension, Search Copilot AI Assistant, and multiple VPN-related extensions. These extensions were found communicating with the same C&C server involved in the Cyberhaven breach, signaling a broad, targeted campaign.
Researchers have discovered that the malicious code in Cyberhaven's extension targeted identity data and access tokens associated with Facebook accounts, specifically Facebook business accounts. This highlights the potential risk these attacks pose to both individual users and organizations relying on such accounts for operations.
Security experts criticize the widespread complacency around browser extension security. Most organizations lack visibility into the extensions installed across their devices, leaving them vulnerable. Since browser extensions often require broad permissions, such as access to cookies or identity information, they represent an overlooked but significant source of risk.
While some extensions have been updated or removed, this incident underscores broader challenges in managing browser extension security. Organizations and users alike must closely monitor installed extensions, limit unnecessary permissions, and remain vigilant against similar threats. The scope and sophistication of this campaign raise serious concerns about the future integrity of browser-based tools.
#Infosec #Cybersecurity #Software #Technology #News #CTF #Cybersecuritycareer #hacking #redteam #blueteam #purpleteam #tips #opensource #cloudsecurity
— 
P.S. Found this helpful? Tap Follow for more cybersecurity tips and insights! I share weekly content for professionals and people who want to get into cyber. Happy hacking 
Gmail Adds Easy Encryption Toggle—But It’s Not True E2EE
This isn’t true end-to-end encryption
Admins still control the keys and can monitor user content
Data is more secure in transit, but not completely private
https://www.theverge.com/news/640422/google-gmail-email-encryption-enterprise-beta
Free Cybersecurity Webcasts from SANS — Now Open for Registration!
Microsoft Defender for Cloud – Best practices & insights
Flexible live or on-demand viewing
Earn CPE credits
Stay current on the latest in cyber
Spring is here – and so is our Spring Sale! 
Now only €14.99!*
Learn more: 
No More End-to-End Encryption for iCloud in the UK!
Read more: 
