Connect with us

Hi, what are you looking for?

American Stock ReviewAmerican Stock Review

Tech News

Hackers hijacked legitimate Chrome extensions to try to steal data

Illustration by Carlo Cadenas / The Verge

A cyberattack campaign inserted malicious code into multiple Chrome browser extensions as far back as mid-December, Reuters reported yesterday. The code appeared designed to steal browser cookies and authentication sessions, targeting “specific social media advertising and AI platforms,” according to a blog post from Cyberhaven, one of the companies that was targeted.

Cyberhaven blames a phishing email for the attack, writing in a separate technical analysis post that the code appeared to specifically target Facebook Ads accounts. According to Reuters, security researcher Jaime Blasco believes the attack was “just random” and not targeting Cyberhaven specifically. He posted on X that he’d found VPN and AI extensions that contained the same malicious code that was inserted into Cyberhaven.

Other extensions possibly affected include Internxt VPN, VPNCity, Uvoice, and ParrotTalks, as Bleeping Computer writes.

Cyberhaven says hackers pushed an update (version 24.10.4) of its Cyberhaven data loss prevention extension containing the malicious code on Christmas Eve at 8:32PM ET. Cyberhaven says it discovered the code on December 25th at 6:54PM ET and removed it within an hour, but that the code was active until December 25th at 9:50PM ET. The company says it released a clean version in its 24.10.5 update.

Cyberhaven’s recommendations for companies that may be affected include that they check their logs for suspicious activity and revoke or rotate any passwords not using the FIDO2 multifactor authentication standard. Prior to publishing its posts, the company notified customers via an email that TechCrunch reported Friday morning.

You May Also Like

Editor's Pick

How do you find the next big stock before it gains the investing public’s attention? It’s tricky, but there are only two ways to...

Tech News

Sony’s “cosmic red” DualSense Wireless Controller is down to $54.99 ($20 off) for a limited time. | Photo by Cameron Faulkner / The Verge...

Tech News

This meat-handed mess was generated using DaVinci AI with the prompt “a photorealistic person looking at their phone with a disgusted expression.” | Image:...

Tech News

Image: Apple Wolfs director Jon Watts told Collider on Friday that he didn’t think a sequel to the George Clooney and Brad Pitt movie,...