Google has removed malicious extensions with 32 million downloads

Google removed dozens of extensions from the Chrome Web Store when a security company discovered that they were using malicious practices to spy on users and steal data.

The security company Awake he argues that encountered a total of 111 malicious or fake Chrome extensions that were able to take screenshots, read the clipboard, collect credentials, and track keystrokes.

Awake says this is one of the biggest malicious campaigns for Chrome users, and its impact is likely to be huge, with all of these extensions having 32 million downloads.

"To date, there have been at least 32.962.951 downloads of these malicious extensions, and this only applies to extensions that have been available in the Chrome Web Store since May 2020."

We do not yet know who was behind this big campaign and how many users were affected, but the attackers appear to have used domains purchased from an Israeli-based company.

"Of the 26.079 domains registered through GalComm, 15.160 or almost 60% are malicious or suspicious: they host various traditional malware and tracking tools used in browsers. With various avoidance techniques, these domains avoided being labeled as malicious by most security solutions and thus allowed this campaign to go unnoticed, ”says Awake.

Google has already removed these extensions and the security company has released one full list with the IDs of the add-ons.