Chrome security extension hacked to steal user data

At least five Chrome extensions have been compromised in a coordinated attack, where a threat actor successfully injected code that stole sensitive information from users.

This is according to cybersecurity experts at Cyberhaven. The US-based data security company warned its customers about a breach that occurred on December 24, following a successful phishing campaign targeting the company’s administrator account on the Google Chrome Store.

Prominent among Cyberhaven's clients are popular brands such as Snowflake, Motorola, Canon, Reddit, AmeriHealth, Cooley, IVP, Navan, DBS, Upstart and Kirkland & Ellis.

Hackers took over employee accounts and released a malicious version (24.10.4) of the Cyberhaven extension, which included code that could steal authenticated sessions and cookies to the attacker's domain (cyberhavenext[.]pro).

Cyberhaven's internal security team removed the malware package within an hour of detection, the company said in an email to customers.

Chrome security extension hacked to steal user data

The clean version of the extension is v24.10.5 which was released on December 26. In addition to upgrading to the latest version, Cyberhaven Chrome extension users are advised to revoke non-FIDOv2 passwords, change all API tokens, and review browser logs to assess for malicious activity.

Many Chrome extensions have been hacked

Following Cyberhaven's disclosure, Nudge Security researcher Jaime Blasco conducted a deeper investigation, redirecting from the attacker's IP address and registered domain name.

Chrome security extension hacked to steal user data

According to Blasco, the malicious code that allowed the extension to receive commands from the attacker was also injected into other Chrome extensions at the same time:

  • Internxt VPN – Free, Encrypted, Unlimited VPN for Secure Browsing. (10,000 users)
  • VPNCity – Privacy-focused VPN with 256-bit AES encryption and global server coverage. (50,000 users)
  • Uvoice – Rewards-based service to earn points through surveys and provide PC usage data. (40,000 users)
  • ParrotTalks – A seamless text and note taking information search engine. (40,000 users)
  • Blasco found multiple domains pointing to several other potential victims, but so far only the above extensions have been confirmed to contain malicious code.

Users of these extensions are advised to immediately remove them from their browsers or upgrade to a secure version released after December 26, after ensuring that the publisher is aware of the security issue and has fixed it.

If you are unsure, it is best to uninstall the extension, reset important account passwords, clear browser data, and reset browser settings to factory defaults.

Leave a Comment

How to Fix Microsoft Teams Error K Security

How to Fix Microsoft Teams Error K Security

Struggling with Microsoft Teams "Error K" Security? Follow our step-by-step guide to fix it quickly—no tech expertise needed. Get back to seamless collaboration today!

How to Fix Microsoft Teams Update Error 0x80070002

How to Fix Microsoft Teams Update Error 0x80070002

Struggling with Microsoft Teams Update Error 0x80070002? Discover step-by-step fixes to resolve it quickly. Clear cache, repair files, and get back to seamless updates today!

Solving Microsoft Teams Web Error Browser Login

Solving Microsoft Teams Web Error Browser Login

Tired of Microsoft Teams "Web Error" blocking your browser login? Follow our step-by-step guide with proven fixes to resolve Teams web login issues fast and securely. Get back to work!

How to Fix Microsoft Teams Error O Offline

How to Fix Microsoft Teams Error O Offline

Stuck with Microsoft Teams "Error O" Offline? Discover proven, step-by-step fixes to get back online fast. Clear cache, restart, and more – no tech skills needed!

Where is Microsoft Teams in Outlook? Locating the Missing Icon

Where is Microsoft Teams in Outlook? Locating the Missing Icon

Frustrated by the missing Microsoft Teams icon in Outlook? Learn exactly where to find it, why it disappears, and proven steps to restore it for effortless meetings. Updated for the latest versions!

Solving Microsoft Teams Windows 10 Error Login Issues

Solving Microsoft Teams Windows 10 Error Login Issues

Struggling with Microsoft Teams "Windows 10 Error" login issues? Get instant fixes for cache clears, updates, and more. Step-by-step solutions to solve Microsoft Teams login error on Windows 10 fast and frustration-free.

Solving Microsoft Teams Website Error Tab Not Loading

Solving Microsoft Teams Website Error Tab Not Loading

Tired of the frustrating Microsoft Teams "Website Error" where tabs won’t load? Get step-by-step fixes to resolve it quickly and boost your productivity. Essential troubleshooting for seamless Teams experience.

How to Fix Microsoft Teams Web Error 503 Service Unavailable

How to Fix Microsoft Teams Web Error 503 Service Unavailable

Tired of the frustrating Microsoft Teams "Web Error" 503 Service Unavailable? Discover proven, step-by-step fixes for Teams 503 error on web. Get back online fast with our expert guide. Works on all browsers!

How to Fix Microsoft Teams Win 7 Error Compatibility

How to Fix Microsoft Teams Win 7 Error Compatibility

Struggling with Microsoft Teams "Win 7 Error" compatibility? Discover step-by-step fixes to restore seamless video calls and chats on unsupported Windows versions. Quick, reliable solutions inside!

Troubleshooting Microsoft Teams Breakout Rooms License Errors

Troubleshooting Microsoft Teams Breakout Rooms License Errors

Master troubleshooting Microsoft Teams Breakout Rooms license errors with this step-by-step guide. Quick fixes for common license issues, admin checks, and prevention tips to get your meetings running smoothly.

How to Fix Microsoft Teams Version History Error

How to Fix Microsoft Teams Version History Error

Struggling with Microsoft Teams "Version History" Error? Discover proven, step-by-step fixes to restore access instantly. Clear cache, update Teams, and more—no tech skills needed!

Solving Microsoft Teams Joining Error: Meeting ID Not Found

Solving Microsoft Teams Joining Error: Meeting ID Not Found

Tired of the frustrating Microsoft Teams Joining Error: Meeting ID Not Found? Get step-by-step fixes to rejoin meetings fast. Updated with the latest Teams patches for seamless collaboration. Solve it now!

Troubleshooting Microsoft Teams Video Error Green Screen

Troubleshooting Microsoft Teams Video Error Green Screen

Struggling with Microsoft Teams "Video Error" green screen? Discover proven, step-by-step troubleshooting fixes for seamless video calls. Quick solutions inside!

How to Fix Microsoft Teams How Teams Works Tutorial Error

How to Fix Microsoft Teams How Teams Works Tutorial Error

Struggling with the Microsoft Teams "How Teams Works" Tutorial Error? Discover proven, step-by-step fixes to resolve it quickly. Clear cache, update, and more for seamless onboarding. Works on latest versions!

How to Fix Microsoft Teams Error Today on Windows 10

How to Fix Microsoft Teams Error Today on Windows 10

Tired of the frustrating Microsoft Teams "Error Today" on Windows 10? Discover proven, step-by-step fixes to resolve it quickly and restore smooth teamwork. No tech skills needed!