sb-au logo
Story image

Attacker goes after Chrome extensions to spread malvertising & spam

17 Aug 2017

Researchers from Proofpoint have discovered evidence of hacked extensions on the Google Chrome browser that were used to steal Google Account credentials. The credentials were stolen through a phishing scheme, which exposed users to popups and theft.

They found that there were several compromised extensions: Web Developer 0.4.9, Chrometana 1.1.3, Infinity New Tab 3.12.3, CopyFish 2.8.5, Web Paind 1.2.1 and Social Fixer 20.1.1 were all modified by the threat actor.

Proofpoint suspects that TouchVPN and Betternet VPN were also targeted by the threat actor back in June.

In the case of Web Developer 0.4.9, the genuine extension was compromised and if installed for ten minutes, it began to execute the rest of the code.

Those who installed the compromised extension found that browser ads were swapped out, essentially hijacking traffic from genuine advertising.

The threat actor also exfiltrated Cloudflare credentials. The company has since closed the malicious activity on their network.

 The threat actor focused most of their attention on substituting ads across adult websites.

“In many cases, victims were presented with fake JavaScript alerts prompting them to “repair” their PC then redirecting them to affiliate programs from which the threat actors could profit,” researchers say in the blog.

PhishMe researchers examined the credential phishing that led to the compromised extensions, particularly the Copyfish plugin. Threat actors were able to lure the developer into a phishing attack which then compromised the account and distributed ads across websites.

“Phishing, now commonly used against all types of accounts and for increasingly-creative purposes, is known to be the number one way that attackers breach our critical processes, steal our intellectual property, and bring businesses to a screeching halt,” PhishMe researchers say.

Proofpoint says that such cases of malicious ad distribution to affiliate programs will continue to evolve.

“In the cases described here, they are leveraging compromised Chrome extensions to hijack traffic and substitute advertisements on victims’ browsers. Once they obtain developer credentials through emailed phishing campaigns, they can publish malicious versions of legitimate extensions. In addition to hijacking traffic and driving users to questionable affiliate programs, we have also observed them gathering and exfiltrating Cloudflare credentials, providing the actors with new means of potential future attacks,” Proofpoint concludes.

Story image
How to stop your data lake from turning into a data swamp
Collecting data is easy – it’s gleaning the intelligence that’s the difficult part. More
Link image
How to prioritise metrics as an e-commerce CTO
E-commerce technology leaders need to track, analyze, and act on large volumes of business and system performance data. Danny Miles, the CTO of Dollar Shave Club, shares a powerful framework for thinking about and prioritizing e-commerce metricsMore
Download image
Why the standard for cloud app authentication keeps getting higher
With this tool, users can choose their authentication method, integrate all apps with one authentication solution and take the stress out of logging in.More
Story image
Distributed workforces pose new challenges for information management
“Collaboration can be stymied, mistakes can be made, and organisations can suffer data breaches if they don’t immediately address the issue of how employees are accessing and sharing information while working remotely.”More
Link image
Real-world SSL/TLS data from 275 billion network flows
According to Gartner, more than 70% of malware campaigns in 2020 would have used some type of encryption… And 60% of organisations will fail to decrypt HTTPS efficiently.More
Link image
Remote workforces can be a security hazard - but they don't have to be
Many companies have adjusted to a new reality: a workforce working from home. These workers need access to applications and files that sit inside the enterprise network, all while prioritising security. Here's how it can be done.More