A chilling discovery by Koi Safety has uncovered a complicated browser hijacking marketing campaign dubbed “RedDirection,” compromising over 1.7 million customers via 11 Google-verified Chrome extensions.
This operation, which additionally spans Microsoft Edge with extra extensions totaling 2.3 million infections throughout platforms, exploited trusted indicators like verification badges, featured placements, and excessive set up counts to distribute malware below the guise of reputable productiveness and leisure instruments.
Unveiling the RedDirection Marketing campaign
Extensions comparable to “Colour Picker, Eyedropper Geco colorpick,” “Video Velocity Controller,” and “Emoji keyboard on-line” have been among the many culprits, delivering promised performance whereas secretly embedding surveillance and redirection mechanisms.
The RedDirection marketing campaign stands out resulting from its misleading technique of remaining benign for years earlier than introducing malicious code by way of silent updates, a tactic that evaded scrutiny from each Google and Microsoft’s extension marketplaces.
These updates, auto-installed with out person intervention, remodeled trusted instruments into surveillance platforms able to monitoring each web site go to, capturing URLs, and redirecting customers to fraudulent pages by way of command-and-control (C2) infrastructure like admitclick.web and click on.videocontrolls.com.
Subtle Malware Deployment
Koi Safety’s investigation revealed that the malware prompts on each tab replace, sending delicate shopping knowledge to distant servers and enabling potential man-in-the-middle assaults.
This might result in devastating situations, comparable to customers being redirected to faux banking or Zoom replace pages, inadvertently handing over credentials or putting in additional malware.
The marketing campaign’s means to weaponize belief indicators comparable to Google’s verified badges and over 100,000 installs per extension highlights a important provide chain failure in market safety.
The verification processes, designed for scale slightly than rigorous scrutiny, not solely didn’t detect the malware but additionally amplified its attain via featured promotions.
What makes this menace much more alarming is the range of the extensions concerned, spanning classes like climate forecasts, darkish themes, quantity boosters, and VPN proxies for platforms like Discord and TikTok.
Every extension operated with particular person C2 subdomains, masking their connection to a centralized assault infrastructure.
This cross-platform operation underscores systemic vulnerabilities in how browser marketplaces deal with extension updates and vetting, turning trusted ecosystems into distribution channels for classy malware.
Koi Safety warns that this isn’t an remoted incident however a watershed second exposing the damaged safety mannequin of present marketplaces, urging instant person motion to uninstall affected extensions, clear browser knowledge, and run malware scans.
As menace actors evolve to take advantage of dormant infrastructure over prolonged intervals, the necessity for sturdy governance and visibility into third-party code turns into paramount, a spot Koi Safety goals to deal with with its platform for enterprise and practitioner safety.
Indicators of Compromise (IOCs)
| Class | Indicator |
|---|---|
| Chrome Extension IDs | kgmeffmlnkfnjpgmdndccklfigfhajen, dpdibkjjgbaadnnjhkmmnenkmbnhpobj, gaiceihehajjahakcglkhmdbbdclbnlf, mlgbkfnjdmaoldgagamcnommbbnhfnhf, eckokfcjbjbgjifpcbdmengnabecdakp, mgbhdehiapbjamfgekfpebmhmnmcmemg, cbajickflblmpjodnjoldpiicfmecmif, pdbfcnhlobhoahcamoefbfodpmklgmjm, eokjikchkppnkdipbiggnmlkahcdkikp, ihbiedpeaicgipncdnnkikeehnjiddck |
| Community Indicators | admitab[.]com, edmitab[.]com, click on.videocontrolls[.]com, c.undiscord[.]com, click on.darktheme[.]web, c.jermikro[.]com, c.untwitter[.]com, c.unyoutube[.]web, admitclick[.]web, addmitad[.]com, admiitad[.]com, abmitab[.]com, admitlink[.]web |
Keep Up to date on Every day Cybersecurity Information. Observe us on Google Information, LinkedIn, and X.
