2.3m users hit as Chrome and Edge extensions turn into Trojans

• Eighteen extensions, initially offering legitimate functionality such as emoji keyboards, weather forecasts, and video speed controllers, were surreptitiously updated to include malicious code, effectively turning them into Trojan horses.
• Compromised extensions operate as man-in-the-middle agents, monitoring users’ browsing activity and redirecting them to malicious websites at the attackers’ discretion.
• Users urged to exercise caution when installing extensions, even those with seemingly positive reputations, and promptly remove any extensions identified as compromised.

In the contemporary digital landscape, browser extensions have become ubiquitous tools, enhancing user experience and extending browser functionality. However, this convenience comes with inherent risks, as malicious actors increasingly exploit browser extensions to compromise user security.

The recent compromise of over 2.3 million users through malicious browser extensions highlights a critical vulnerability in the current ecosystem of web application security.

A sophisticated campaign, dubbed RedDirection, has demonstrated the ease with which seemingly innocuous tools can be transformed into potent surveillance malware.

Eighteen extensions, initially offering legitimate functionality such as emoji keyboards, weather forecasts, and video speed controllers, were surreptitiously updated to include malicious code, effectively turning them into Trojan horses.

Limitations of verification processes

The insidious nature of this attack lies in its exploitation of the trust users place in established extensions. One of the compromised extensions even boasted a Google verified badge, numerous positive reviews, and a prominent placement on the Chrome Web Store, illustrating the limitations of existing verification processes.

The malicious updates were silently installed on users’ browsers, requiring no active participation or consent. This “no phishing, no social engineering” approach underscores the sophisticated nature of the threat, as it bypassed traditional security awareness measures.

The consequences of this breach are far-reaching. The compromised extensions operate as man-in-the-middle agents, monitoring users’ browsing activity and redirecting them to malicious websites at the attackers’ discretion.

This capability allows for targeted phishing attacks, credential theft, and the potential delivery of further malware. The fact that each extension functioned as advertised while simultaneously engaging in malicious activity further complicates detection and mitigation efforts.

RedDirection campaign

The RedDirection campaign serves as a stark reminder of the need for more robust security measures within the browser extension ecosystem.

Google and Microsoft must re-evaluate their extension update mechanisms to prevent silent, malicious updates from being automatically installed. Enhanced verification processes, including continuous monitoring of extension code for suspicious behavior, are crucial to detecting and mitigating similar threats in the future.

Users should also exercise caution when installing extensions, even those with seemingly positive reputations, and promptly remove any extensions identified as compromised.

Furthermore, implementing mitigation measures such as clearing browser data and performing full system malware scans is essential to minimising the potential impact of this widespread security breach.

Security firm Malwarebytes issued urgent advisory, urging users to take proactive measures to mitigate potential harm caused by malicious extensions. Their recommendations highlight the critical steps individuals should take to protect their data and accounts.

Resetting browser settings

Malwarebytes advises affected users to meticulously clear all browsing data, including browsing history, cookies, cached files, and site data. This action aims to expunge any tracking identifiers or session tokens that may have been stolen or set by malicious extensions, thus preventing unauthorised access and tracking.

Furthermore, resetting browser settings to their default state is crucial to undo any modifications made by the extension to search engines, homepages, or other settings. Users should be vigilant for signs of compromise, such as unexpected redirects, altered search engines, or the appearance of unfamiliar toolbars.

Beyond browser-specific actions, Malwarebytes emphasizes the importance of securing online accounts. Users are strongly advised to immediately change passwords for accounts accessed while the malicious extension was active, particularly sensitive accounts like online banking platforms. Employing a reliable password manager to generate strong, complex, and unique passwords is paramount.

Moreover, enabling two-factor authentication (2FA) wherever possible adds an extra layer of security, making it significantly more difficult for unauthorized individuals to gain access. Vigilant monitoring of accounts for any suspicious activity and scrutiny of email and text messages for security alerts are also essential components of a comprehensive security strategy.

A full system scan

Maintaining an up-to-date browser and ensuring all remaining extensions are current is another critical step. Malwarebytes also recommends conducting a full system scan with a reputable antivirus solution to detect and remove any residual malware.

The security firm highlights the importance of carefully scrutinizing extension permission requests, especially after updates. Suspicious requests for additional permissions should raise red flags and prompt a thorough investigation of the extension’s legitimacy.

The advisory underscores the evolving nature of cyber threats, noting that hackers frequently develop or acquire extensions, which researchers have dubbed “sleeper agents,” designed for future malicious activities.

The example of malicious extensions masquerading as ChatGPT search tools demonstrates the potential for trusted extensions to turn malicious after a period of dormancy.

Given that any browser supporting extensions can be targeted, security experts recommend regular review of all installed extensions, with the removal of any unwanted add-ons. Users should be wary of unusual behaviour, recognising that even previously trusted extensions can be compromised through updates.