Cybersecurity firm’s Chrome extension hijacked to steal users’ data

At least five Chrome extensions were compromised in a coordinated attack where a threat actor injected code that steals sensitive information from users.

One attack was disclosed by Cyberhaven, a data loss prevention company that alerted its customers of a breach on December 24 after a successful phishing attack on an administrator account for the Google Chrome store.

Among Cyberhaven’s customers are Snowflake, Motorola, Canon, Reddit, AmeriHealth, Cooley, IVP, Navan, DBS, Upstart, and Kirkland & Ellis.

The hacker hijacked the employee’s account and published a malicious version (24.10.4) of the Cyberhaven extension, which included code that could exfiltrate authenticated sessions and cookies to the attacker’s domain (cyberhavenext[.]pro).

Cyberhaven’s internal security team removed the malicious package within an hour since its detection, the company says in an email to its customers.

A clean version of the extension, v24.10.5 was published on December 26. Apart from upgrading to the latest version, users of the Cyberhaven Chrome extension are recommended to revoke passwords that aren’t FIDOv2, rotate all API tokens, and review browser logs to evaluate malicious activity.

More Chrome extensions breached

Following Cyberhaven’s disclosure, Nudge Security researcher Jaime Blasco took the investigation further, pivoting from the attacker’s IP addresses and registered domains.

According to Blasco, the malicious code snippet that let the extension receive commands from the attacker was also injected around the same time in other Chrome extensions:

• Internxt VPN – Free, encrypted, unlimited VPN for secure browsing. (10,000 users)
• VPNCity – Privacy-focused VPN with AES 256-bit encryption and global server coverage. (50,000 users)
• Uvoice – Rewards-based service for earning points through surveys and providing PC usage data. (40,000 users)
• ParrotTalks – Information search tool specializing in text and seamless note-taking. (40,000 users)

Blasco found more domains that point to other potential victims but only the extensions above were confirmed to carry the malicious code snippet.

Cybersecurity researcher John Tuckner has found an additional set of extensions which also had the same malicious snippet injected on their code.

These are Bookmark Favicon Changer, Castorus, Wayin AI, Search Copilot AI Assistant, VidHelper, Vidnoz Flex, TinaMind, Primus, AI Shop Buddy, Sort by Oldest, Earny, ChatGPT Assistant, Keyboard History Recorder, and Email Hunter.

The additional set of extensions infected by the data stealing code have a collective download count of almost 380,000.

There have also been additional cases of compromise such as Visual Effects for Google Meet, Rewards Search Automator, Tackker, Bard AI chat, and Reader Mode, but these have been removed from Chrome’s Web Store.

Users of these extensions are recommended to either remove them from the browser or upgrade to a safe version published after December 26 after making sure that the publisher has learned about the security issue and fixed it.

If unsure, it would be better to uninstall the extension, reset important account passwords, clear browser data, and reset browser settings to their original defaults.

Keep Aware has also published a write-up where they share more info about the functionality of the malicious code and how to detect compromise.

Update 12/30 – Added more extensions confirmed to have been compromised, and link to more info about the code.