A report by security company Radware shows that its users Google Chrome exposed to yet another wave of malicious extensions offered to them by the official Chrome Web Store.
Η Radware company reports that these extensions were used to perform “credential theft, encryption, click fraud and more”. According to analysis της Radware, το κακόβουλο λογισμικό που ανακάλυψαν ήταν ενεργό τουλάχιστον από τον Μάρτιο του 2018. Έχει μολύνει περισσότερες από 100.000 Appliances users in over 100 countries and proceeded to install at least seven other different Chrome extensions with malicious content using the following attack method:
1. Attackers use Facebook advertising to reach potential victims.
2. Users are redirected to fake YouTube pages.
3. A question appears asking them to install one extension of Chrome to play the video.
4. Clicking on "add extension" installs the extension and makes the user part of a botnet.
5. Malicious JavaScript runs during installation, which installs additional code from a command center.
The extensions used by the attackers were copies of various popular extensions of Chrome, with a similar name, but which contained additional malicious code within them. According to Radware's research, the following extensions (not the same but copies of them) have been identified as malicious:
Nigelify
PwnerLike
Alt-j
Fixed-case
Divinity 2 Original Sin: Wiki Skill Popup
keeprivate
iHabno
In the photo above the left extension is the normal one and the right one is the malicious one.
You can check the company website for extension IDs as well as other information. Google has already removed all of these copy-extensions.
Considering that the attackers have been operating the extensions since March 2018, it is clear - again - that Google's protection system is not working properly.
Chrome users should verify any extensions they are interested in before deciding to click the install button. One rule of thumb is that you should never install extensions that ask you to do this outside of the Chrome Web Store, but because as you can see there are malicious extensions hosted on the Store, this rule is not a panacea.
The main problem is that the majority of users can not check whether a Chrome extension is legal or not, as to be absolutely sure you need to analyze its code.
