Researchers believe that the actor behind this campaign was active since January 2019, with activity escalating between March and June. Through collaboration, we were able to take the few dozen extensions and… identify 70 matching their patterns across 1.7 million users and escalate concerns to Google.” “ discovered they were part of a network of copycat plugins sharing nearly identical functionality. “These extensions were commonly presented as offering advertising as a service,” according to Jamila Kaya, an independent security researcher, and Jacob Rickerd, with Duo Security, in a Thursday analysis. In this particular instance, bad actors were redirecting victims from legitimate online ad streams to malware-laced pages. Malvertising often is used as a vehicle for fraudulent activity, including data exfiltration, phishing or ad fraud. But researchers said that the malicious extensions they discovered are instead part of a massive malvertising campaign that also harvested browser data.
The browser extensions, all of which have now been removed, were downloaded millions of times from Google’s Chrome Web Store.īrowser extensions are used for customizing web browsers, modifying user interfaces, blocking ads and managing cookies.
Researchers say that 500 Google Chrome browser extensions were discovered secretly uploading private browsing data to attacker-controlled servers, and redirecting victims to malware-laced websites.
0 kommentar(er)
