New particulars reveal how hackers hijacked 35 Google Chrome extensions

New particulars have emerged a few phishing marketing campaign concentrating on Chrome browser extension builders that led to the compromise of not less than thirty-five extensions to inject data-stealing code, together with these from cybersecurity agency Cyberhaven.

Though preliminary experiences centered on Cyberhaven’s security-focused extension, subsequent investigations revealed that the identical code had been injected into not less than 35 extensions collectively utilized by roughly 2,600,000 individuals.

From experiences on LinkedIn and Google Teams from focused builders, the most recent marketing campaign began round December fifth, 2024. Nonetheless, earlier command and management subdomains discovered by BleepingComputer existed way back to March 2024.

“I simply needed to alert individuals to a extra subtle phishing e mail than ordinary that we received that acknowledged a Chrome Extension coverage violation of the shape: ‘Pointless particulars within the description’,” reads the submit to Google Group’s Chromium Extension’s group.

“The hyperlink on this e mail seems to be just like the webstore however goes to a phishing web site that can attempt to take management of your chrome extension and sure replace it with malware.”

A misleading OAuth assault chain

The assault begins with a phishing e mail despatched to Chrome extension builders instantly or by means of a assist e mail related to their area identify.

From emails seen by BleepingComputer, the next domains had been used on this marketing campaign to ship the phishing emails:

supportchromestore.com
forextensions.com
chromeforextension.com

The phishing e mail, which is made to seem as if it comes from Google, claims that the extension is in violation of Chrome Internet Retailer insurance policies and is prone to being eliminated.  

“We don’t enable extensions with deceptive, poorly formatted, non-descriptive, irrelevant, extreme, or inappropriate metadata, together with however not restricted to the extension description, developer identify, title, icon, screenshots, and promotional photographs,” reads the phishing e mail.

Particularly, the extension’s developer is led to imagine their software program’s description comprises deceptive data and should comply with the Chrome Internet Retailer insurance policies.

If the developer clicks on the embedded ‘Go To Coverage’ button in an effort to know what guidelines they’ve violated, they’re taken to a respectable login web page on Google’s area for a malicious OAuth software.

The web page is a part of Google’s commonplace authorization stream, designed for securely granting permissions to third-party apps to entry particular Google account assets.

On that platform, the attacker hosted a malicious OAuth software named “Privateness Coverage Extension” that requested the sufferer to grant permission to handle Chrome Internet Retailer extensions by means of their account.

“If you enable this entry, Privateness Coverage Extension will be capable to: See, edit, replace, or publish your Chrome Internet Retailer extensions, themes, apps, and licenses you’ve gotten entry to,” reads the OAuth authorization web page.

Multi-factor authentication did not assist shield the account as direct approvals in OAuth authorization flows aren’t required, and the method assumes the consumer absolutely understands the scope of permissions they’re granting.

“The worker adopted the usual stream and inadvertently licensed this malicious third-party software,” explains Cyberhaven in a autopsy writeup.

“The worker had Google Superior Safety enabled and had MFA overlaying his account. The worker didn’t obtain an MFA immediate. The worker’s Google credentials weren’t compromised.”

As soon as the menace actors gained entry to the extension developer’s account, they modified the extension to incorporate two malicious information, particularly ’employee.js’ and ‘content material.js,’ which contained code to steal information from Fb accounts.

The hijacked extension was then revealed as a “new” model on the Chrome Internet Retailer.

Whereas Extension Complete is monitoring thirty-five extensions impacted by this phishing marketing campaign, IOCs from the assault point out {that a} far higher quantity had been focused.

In line with VirusTotal, the menace actors pre-registered domains for focused extensions, even when they didn’t fall for the assault.

Whereas most domains had been created in November and December, BleepingComputer discovered that the menace actors had been testing this assault in March 2024.

Focusing on Fb enterprise accounts

Evaluation of compromised machines confirmed that the attackers had been after the Fb accounts of customers of the poisoned extensions.

Particularly, the data-stealing code tried to seize the consumer’s Fb ID, entry token, account information, advert account data, and enterprise accounts.

Moreover, the malicious code added a mouse click on occasion listener particularly for the sufferer’s interactions on Fb.com, in search of QR code photographs associated to the platform’s two-factor authentication or CAPTCHA mechanisms.

This aimed to bypass 2FA protections on the Fb account and permit the menace actors to hijack it.

The stolen data can be packaged along with Fb cookies, the consumer agent string, Fb ID, and the mouse click on occasions and exfiltrated to the attacker’s command and management (C2) server.

Menace actors have been concentrating on Fb enterprise accounts through varied assault pathways to make direct funds from the sufferer’s credit score to their account, run disinformation or phishing campaigns on the social media platform, or monetize their entry by promoting it to others.