36 Chrome Extensions Compromised in Supply Chain Attack

A supply chain attack that subverted legitimate Google Chrome browser extensions is more widespread than security researchers first suspected.

See Also: Cracking the Code: Securing Machine Identities

Researchers have identified three dozen Chrome extensions, collectively used by 2.6 million people, into which an attacker injected data-stealing malware (see: Hackers Launch Supply Chain Attack Against Chrome Extensions).

“At this moment, the scope of the compromised extensions seems to be contained, so far a total of 36 compromised Chrome extensions were detected,” said Amit Assaraf, CEO at ExtensionTotal.com, a startup that builds a platform designed to better monitor and secure third-party extensions, in a blog post.

Browser extensions are a regular target for attackers, who seek to subvert them and gain access to victims’ browsers and the data they store, including passwords and session cookies.

One recently compromised Chrome extension traced to cybersecurity startup Cyberhaven, which offers an eponymous Chrome browser extension designed to safeguard corporate data from insider threats, including accidental exposure.

ExtensionTotal said about 400,000 people appear to use Cyberhaven’s extension; not all would have been affected.

Cyberhaven first warned customers on Dec. 26 that one of its employees fell victim to a phishing attack, resulting in the attacker being able to upload a modified version of the extension with malicious code added. The company said the attack “only affected machines that were online between 1:32 a.m. UTC on Dec. 25, 2024, and 2:50 a.m. UTC on Dec. 26, 2024,” which ran version 24.10.4 of its extension.

The company updated the extension to version 24.10.5, removing the malicious code. CEO Howard Ting urged customers to “force an update” to that or a newer version, saying only a legitimate was by then being hosted on the Chrome Web Store.

In a preliminary analysis of the incident released on Dec. 27, the company said the attacker used a legitimate Google authorization flow to try and trick targeted developers into adding a malicious OAuth Google application called “Privacy Policy Extension.” Because the authorization flow was legitimate, the process wasn’t protected by any multifactor authentication prompt.

Any developer who inadvertently authorized the malicious Privacy Policy Extension gave the attacker the ability to upload a modified version of extension, with data-grabbing malware. Cyberhaven said attackers’ goal appeared to be stealing passwords for both personal and business Facebook accounts from extension users, and it recommended all users rotate those passwords on any affected machines, as well as “review all logs to verify no outbound connections to the attacker’s domain or other malicious activity.”

Veteran cybersecurity researcher Jaime Blasco, co-founder and CTO at Nudge Security, detailed in a LinkedIn post some of the other compromised Chrome extensions, including Internxt VPN, VPNCity, Uvoice and ParrotTalks.

“I recommend you search for them in your environment,” he said. “Also look for any traffic to 149.28.124.84,” which is the URL for the attacker’s command-and-control server.

Phishing Attacks

Details shared by Cyberhaven and other developers suggest whoever was behind the phishing campaign targeted developers listed as public contact points for various Chrome extensions.

The attacks appear to have begun around Dec. 5. Developer Denis Podgurskii reported seeing a “Chrome extension developers scam,” after he received a phishing email that day pertaining to the OWASP Penetration Testing Kit extension he maintains, tied to a purported violation of Chrome Web Store rules. The penetration testing kit counts 20,000 Chrome users, and is also available for Firefox and Microsoft Edge browser users.

Podgurskii said the email was sent from chromewebstore-noreply@forextensions.com – an address Chrome would never use – with the domain having first been registered on Sept. 29. The email itself included a “go to policy” link to malicious site https://app.extensionpolicy.net/check-policy, with that domain only having been registered on Nov. 29.

“If you open this link (use sandbox browser!), it will ask you to log in using your Chrome developer account (thanks but no),” he said.

One week later, a member of the Chromium Extensions Google Group warned users to “beware phishing in Chrome Web Store,” based on an in-the-wild attack.

“I just wanted to alert people to a more sophisticated phishing email than usual that we got that stated a Chrome Extension policy violation,” according to his post. “The link in this email looks like the webstore but goes to a phishing website that will try to take control of your Chrome extension and likely update it with malware.”

“You saved us,” one developer responded to the group, hours later, sharing an email he received from chromewebstore-noreply@forextensions.com that otherwise had the “exact format” of a Chrome Store message.

The phishing emails appear to have come not just from forextensions.com but also chromeforextension.com and supportchromestore.com, BleepingComputer reported, noting that earlier versions of the campaign might date from March 2024, based on command-and-control subdomains it tracked.

Tools for Detecting Attacks

Attackers don’t appear to have reinvented the wheel to target different Chrome extensions, meaning that researchers have seen similar indicators of compromise across all compromised extensions.

Cyberhaven on Tuesday released a set of open-source tools, for free on its GitHub repository, designed to look for these signs of attack.

“This repository contains various scripts and resources that assist in identifying the Chrome extension versions, and searching Chrome local storage for potentially malicious entries,” according to the release notes. “These scripts search for entries indicating that a malicious extension has exfiltrated data.”

The company said it believes the scripts could additionally help detect future zero-day attacks – provided attackers attempt to reuse similar tactics – and bolster endpoint detection and response tools “in the first hours of a zero-day, before EDR solutions update their databases,” as well as for organizations and consumers who don’t have EDR tools to detect such attacks.