New details have emerged about a phishing campaign targeting Chrome browser extension developers that led to the compromise of at least thirty-five extensions to inject data-stealing code, including those from cybersecurity firm Cyberhaven.
Although
initial reports focused on Cyberhaven's security-focused extension, subsequent investigations revealed that the same code had been injected into at least
35 extensions collectively used by roughly 2,600,000 people.
From reports on
LinkedIn and
Google Groups from targeted developers, the latest campaign started around December 5th, 2024. However, earlier command and control subdomains found by BleepingComputer existed as far back as March 2024.
"I just wanted to alert people to a more sophisticated phishing email than usual that we got that stated a Chrome Extension policy violation of the form: 'Unnecessary details in the description'," reads the post to Google Group's Chromium Extension's group.
"The link in this email looks like the webstore but goes to a phishing website that will try to take control of your chrome extension and likely update it with malware."
arstechnica.com
