35 Chrome Extensions Hacked, 2.6 Million Users Exposed - See If You're Affected

By Chandramohan Rajput | Jan 03, 2025 NEWS

Massive Extension Breach

[{"selector":"#anim-c6bdd524-8175-4b16-9597-7f2edaf89ecc [data-leaf-element=\"true\"]","keyframes":{"transform":["translate(16.819850744623594%, 0%) scale(1.5)","translate(0%, 0%) scale(1)"]},"delay":0,"duration":3000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] [{"selector":"#anim-76594a1c-518a-4e37-8f71-5214c5c453c0","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-81890e78-c01c-45cc-8c85-0a468d27f3be","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-9fbd19cd-d863-475f-a593-f023a4bfedc4","keyframes":{"transform":["translate3d(0px, 141.27990%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-2ccb74c2-2d57-4067-a1f2-d852c8341a75","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-994cbf62-94bb-4c11-97eb-77d664367e6c","keyframes":{"transform":["translate3d(-180.00001%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] Hackers have escalated their campaign, compromising 35 Chrome extensions used by more than 2.6 million people. The breach exposes growing risks in browser security. 7FB806

List of some Hacked Chrome Extensions

[{"selector":"#anim-f84c9824-47eb-45b8-85d2-8bffe22ed41f","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-ebe45887-741e-4696-8067-573f9d7e4a39","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-5bc55777-e2c5-446b-8d84-adfeadc964b4","keyframes":{"transform":["translate3d(0px, 108.06975%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-3856b6fe-51b6-47d9-832d-31dace5b5aad","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-05ae2bbd-2bb3-4826-9eff-ea808e1d7f9f","keyframes":{"transform":["translate3d(-180.00001%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] - Where is Cookie? - Web Mirror - ChatGPT App - Hi AI - Web3Password Manager - YesCaptcha assistant - Bookmark Favicon Changer - Proxy SwitchyOmega - GraphQL Network Inspector - AI Assistant - Bard AI chat - ChatGPT for Google Meet - Search Copilot AI Assistant for Chrome - TinaMind - Wayin AI - VPNCity - Internxt VPN - Vidnoz Flex - VidHelper - Castorus - Uvoice - Reader Mode View More

Targeted Phishing Emails

[{"selector":"#anim-0c5a30a7-dd25-4985-9eb7-6be7b4144ddd [data-leaf-element=\"true\"]","keyframes":{"transform":["translate(0.7138870798745464%, -22.522520037690047%) scale(1.4504504504504505)","translate(0%, 0%) scale(1)"]},"delay":0,"duration":3000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] [{"selector":"#anim-c80c8327-15ec-40ff-8c02-f1d71a537ec2","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-4d1e9131-5b9b-4b25-8b88-6645e1963bd8","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-c60f950c-b35d-4c5f-8f0d-dd7ae8932737","keyframes":{"transform":["translate3d(0px, 170.39865%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-bb082fc0-e6fc-4cdc-84da-3fb6e3c6bcbb","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-c004f233-6f72-4983-8b22-b068ad38c905","keyframes":{"transform":["translate3d(-180.00001%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] Developers received phishing emails mimicking Google policy violation notices. These emails tricked them into granting access to malicious apps.

OAuth Exploited to Bypass MFA

[{"selector":"#anim-f177ecb9-a110-43a1-bebc-825a76c15cb3 [data-leaf-element=\"true\"]","keyframes":{"transform":["translate3d(-11.559887039651805%, 0, 0) translate(-21.739130434782606%, -21.669455490681862%) scale(1.434782608695652)","translate3d(0%, 0, 0) translate(0%, 0%) scale(1)"]},"delay":0,"duration":2000,"fill":"forwards"}] [{"selector":"#anim-fa9483a9-8748-4441-a4b3-d81627c21c67","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-c041a854-86d8-45c4-97d8-07fbd648c197","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-f40ac8da-07b3-4470-aa18-c3abbf1e5011","keyframes":{"transform":["translate3d(0px, 169.44442%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-9077eaaa-5566-45cd-b48d-32057dfae4e6","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-9b6c2d18-9bba-417d-892b-b5a3f8a50f78","keyframes":{"transform":["translate3d(-180.00001%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] Attackers used a fake OAuth app to gain control of developer accounts. Multi-factor authentication didn’t prevent these breaches.

Malicious Code Injected

[{"selector":"#anim-ad96cb86-4613-4037-8e8e-6888a341b282 [data-leaf-element=\"true\"]","keyframes":{"transform":["translate3d(-16.942497971841867%, 0, 0)","translate3d(0%, 0, 0)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-c8e5fe64-a82e-4f03-9e4b-b2de004c04d7","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-34237411-08ba-4afc-91e9-831e767314a2","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-c2938cb4-32f5-4d60-8518-bfc47fcc421a","keyframes":{"transform":["translate3d(0px, 171.70939%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-b1aaf530-c5a3-4ac4-acc8-849640c9b7b3","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-0cc84777-f169-425f-9eec-1b565813a8db","keyframes":{"transform":["translate3d(-180.00001%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] Malicious scripts were added to compromised extensions in order to steal sensitive information, with a focus on Facebook business accounts.

Focus on Facebook Accounts

[{"selector":"#anim-41d911b5-2018-4693-8e22-edabdf003eb5 [data-leaf-element=\"true\"]","keyframes":{"transform":["translate(10.843506515714152%, -11.185258310841217%) scale(1.3424657534246576)","translate(0%, 0%) scale(1)"]},"delay":0,"duration":3000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] [{"selector":"#anim-d07cdb51-999b-49cf-94a1-ade9c3ca1a0c","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-8d9ebec3-82f1-4f8a-bf81-1787129e88db","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-339ae013-fdf8-4d19-94aa-bf0c49bfcdaa","keyframes":{"transform":["translate3d(0px, 175.21369%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-75e99c89-5bd1-4a81-ac06-0f2b70ae2248","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-8f5aa8e0-403f-4f00-803e-fbf7dc5c58d6","keyframes":{"transform":["translate3d(-180.00001%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] The stolen data included Facebook IDs, cookies, and ad account information. Hackers intended to hijack and monetize accounts.

What You Should Do?

[{"selector":"#anim-866d58bf-7cf1-479d-ae97-3c3ad2e48cd0 [data-leaf-element=\"true\"]","keyframes":{"transform":["translate3d(34.179687404002955%, 0, 0) translate(25%, 0%) scale(1.5)","translate3d(0%, 0, 0) translate(0%, 0%) scale(1)"]},"delay":0,"duration":2000,"fill":"forwards"}] [{"selector":"#anim-c236a921-350d-4f00-a647-94d0f6878170","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-4b546e3d-a8e6-4607-8c7a-04976523bd72","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-50f44c88-81dc-4c53-afcf-409772ffa17b","keyframes":{"transform":["translate3d(0px, 144.78631%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-db99d09e-96d7-4854-bd51-80a7ef4a8634","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-0e007459-ff40-4b69-9f6a-9db7fa44b033","keyframes":{"transform":["translate3d(-180.00001%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] You should update your extensions right away, audit your installations, and keep an eye on your accounts for any unusual activity.