Researchers at SquareX Labs discovered a new "polymorphic" attack where malicious Chrome extensions can transform to impersonate trusted tools like password managers. After installation, these extensions identify valuable targets using the chrome.management API, disable them, change their ...
Security researchers uncover 'Browser Syncjacking', a new cyber attack that exploits Chrome extensions and sync features to gain complete device control. By using malicious Google Workspace domains and legitimate-looking extensions, attackers can access passwords, browsing data, and system...
A large-scale phishing campaign has compromised 35 Chrome extensions affecting 2.6 million users by targeting developers through fake Google policy violation notices. Attackers used malicious OAuth applications to gain access and modify extensions with code designed to steal Facebook user ...
A widespread attack campaign targeting Chrome extensions has compromised 16 extensions, affecting over 600,000 users. Attackers used phishing to target extension publishers, injecting malicious code to steal cookies and access tokens, particularly focusing on Facebook business credentials....
