Story image

Attacker goes after Chrome extensions to spread malvertising & spam

17 Aug 17

Researchers from Proofpoint have discovered evidence of hacked extensions on the Google Chrome browser that were used to steal Google Account credentials. The credentials were stolen through a phishing scheme, which exposed users to popups and theft.

They found that there were several compromised extensions: Web Developer 0.4.9, Chrometana 1.1.3, Infinity New Tab 3.12.3, CopyFish 2.8.5, Web Paind 1.2.1 and Social Fixer 20.1.1 were all modified by the threat actor.

Proofpoint suspects that TouchVPN and Betternet VPN were also targeted by the threat actor back in June.

In the case of Web Developer 0.4.9, the genuine extension was compromised and if installed for ten minutes, it began to execute the rest of the code.

Those who installed the compromised extension found that browser ads were swapped out, essentially hijacking traffic from genuine advertising.

The threat actor also exfiltrated Cloudflare credentials. The company has since closed the malicious activity on their network.

 The threat actor focused most of their attention on substituting ads across adult websites.

“In many cases, victims were presented with fake JavaScript alerts prompting them to “repair” their PC then redirecting them to affiliate programs from which the threat actors could profit,” researchers say in the blog.

PhishMe researchers examined the credential phishing that led to the compromised extensions, particularly the Copyfish plugin. Threat actors were able to lure the developer into a phishing attack which then compromised the account and distributed ads across websites.

“Phishing, now commonly used against all types of accounts and for increasingly-creative purposes, is known to be the number one way that attackers breach our critical processes, steal our intellectual property, and bring businesses to a screeching halt,” PhishMe researchers say.

Proofpoint says that such cases of malicious ad distribution to affiliate programs will continue to evolve.

“In the cases described here, they are leveraging compromised Chrome extensions to hijack traffic and substitute advertisements on victims’ browsers. Once they obtain developer credentials through emailed phishing campaigns, they can publish malicious versions of legitimate extensions. In addition to hijacking traffic and driving users to questionable affiliate programs, we have also observed them gathering and exfiltrating Cloudflare credentials, providing the actors with new means of potential future attacks,” Proofpoint concludes.

How to stay safe when shopping online
Online shopping is a great way to avoid the crowds – but there are risks.
Dell EMC embeds security in latest servers
Dell EMC's 14th generation of PowerEdge servers has comprehensive management tools to provide security across hardware and firmware.
Why data backups should be a part of daily operations
"Disaster recovery needs to address complete system failure and provide a set of security policies to govern disaster incidents."
Businesses focusing on threats from within - survey
Over 50% of respondents reported that 100 days of dwell time or more was representative of their organisation.
Corelight and Exabeam partner to improve network monitoring
The combination of lateral movement and siloed usage of point security products leaves many security teams vulnerable to compromise.
SailPoint releases first identity annual report
SailPoint’s research found that many organisations are lacking maturity in their governance processes over identities.
Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."
Businesses too slow on attack detection – CrowdStrike
The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 cases.