sb-as logo
Story image

Attacker goes after Chrome extensions to spread malvertising & spam

17 Aug 2017

Researchers from Proofpoint have discovered evidence of hacked extensions on the Google Chrome browser that were used to steal Google Account credentials. The credentials were stolen through a phishing scheme, which exposed users to popups and theft.

They found that there were several compromised extensions: Web Developer 0.4.9, Chrometana 1.1.3, Infinity New Tab 3.12.3, CopyFish 2.8.5, Web Paind 1.2.1 and Social Fixer 20.1.1 were all modified by the threat actor.

Proofpoint suspects that TouchVPN and Betternet VPN were also targeted by the threat actor back in June.

In the case of Web Developer 0.4.9, the genuine extension was compromised and if installed for ten minutes, it began to execute the rest of the code.

Those who installed the compromised extension found that browser ads were swapped out, essentially hijacking traffic from genuine advertising.

The threat actor also exfiltrated Cloudflare credentials. The company has since closed the malicious activity on their network.

 The threat actor focused most of their attention on substituting ads across adult websites.

“In many cases, victims were presented with fake JavaScript alerts prompting them to “repair” their PC then redirecting them to affiliate programs from which the threat actors could profit,” researchers say in the blog.

PhishMe researchers examined the credential phishing that led to the compromised extensions, particularly the Copyfish plugin. Threat actors were able to lure the developer into a phishing attack which then compromised the account and distributed ads across websites.

“Phishing, now commonly used against all types of accounts and for increasingly-creative purposes, is known to be the number one way that attackers breach our critical processes, steal our intellectual property, and bring businesses to a screeching halt,” PhishMe researchers say.

Proofpoint says that such cases of malicious ad distribution to affiliate programs will continue to evolve.

“In the cases described here, they are leveraging compromised Chrome extensions to hijack traffic and substitute advertisements on victims’ browsers. Once they obtain developer credentials through emailed phishing campaigns, they can publish malicious versions of legitimate extensions. In addition to hijacking traffic and driving users to questionable affiliate programs, we have also observed them gathering and exfiltrating Cloudflare credentials, providing the actors with new means of potential future attacks,” Proofpoint concludes.

Story image
COVID-19 crushes fingerprint reader market
However, the biometrics market is expected to regain momentum with alternatives already beginning to find their feet.More
Story image
The business case for an in-house ethical hacker
Ethical hackers, also known as penetration testers or white-hat hackers, mimic the techniques used by malicious hackers to try and break into computer systems and discover vulnerabilities before the bad guys can exploit them.More
Story image
The rising threat of human-controlled ransomware
Until recently, most ransomware attacks have been automated affairs. But things are changing, writes Attivo Networks regional director for A/NZ Jim Cook.More
Story image
Gartner reveals the top strategic tech trends for 2021
“CIOs are striving to adapt to changing conditions to compose the future business - this requires the organisational plasticity to form and reform dynamically. Gartner’s top strategic technology trends for 2021 enable that plasticity.”More
Story image
Insider threat report reveals deception in the workforce
Insider threats come from people inside an enterprise, whether they divulge proprietary information with nefarious intentions, or are just careless employees that unwittingly share sensitive data, writes Bitglass product marketing manager Juan Lugo.More
Story image
Financial institutions in APAC region to invest millions in fraud prevention
"The pandemic is creating a lot of uncertainty, but the majority of FIs in APAC recognise that an end to end fraud management platform is strategic to differentiating themselves from the highly disruptive landscape they are playing in."More