Trusted Design

Threat actor goes on a Chrome extension hijacking spree

概要

Chrome Extensions are a powerful means of adding functionality to the Chrome browser with features ranging from easier posting of content on social media to integrated developer tools. At the end of July and beginning of August, several Chrome Extensions were compromised after their author’s Google Account credentials were stolen via a phishing scheme. This resulted in hijacking of traffic and exposing users to potentially malicious popups and credential theft. We specifically examined the “Web Developer 0.4.9” extension compromise, but found evidence that “Chrometana 1.1.3”, “Infinity New Tab 3.12.3” [8][10] , “CopyFish 2.8.5” [9], “Web Paint 1.2.1” [11], and “Social Fixer 20.1.1” [12] were modified using the same modus operandi by the same actor. We believe that the Chrome Extensions TouchVPN and Betternet VPN were also compromised in the same way at the end of June.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• Large Malvertising Campaign Goes (Almost) Undetected (score: 0.60)
• New Spy Banker Trojan Telax abusing Google Cloud Servers (score: 0.58)
• Chinese Government Website Compromised, Leads to Angler (score: 0.56)
• Privileges and Credentials: Phished at the Request of Counsel (score: 0.55)
• Striking Oil: A Closer Look at Adversary Infrastructure (score: 0.55)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る