chrome extensions

New Syncjacking attack exploits benign Chrome extensions to hijack devices via Google profile and browser takeover. Attackers create a malicious Google Workspace domain, trick victims into installing an extension, and gain access to their data after syncing. They further take control through a fake Zoom update, allowing extensive control over the victim's browser and files while remaining stealthy and requiring minimal user interaction.

https://www.bleepingcomputer.com/news/security/new-syncjacking-attack-hijacks-devices-using-chrome-extensions/

Legitimate Chrome extensions are stealing Facebook passwords via a sophisticated multi-stage attack. Cybercriminals compromised popular extensions, resulting in trojan updates that harvested user data and credentials for Meta services, allowing attackers to misuse business accounts for ad placements. Developers were tricked into authorizing malicious updates through phishing attempts disguised as Google alerts. Users with infected extensions were at risk of losing sensitive information, prompting urgent advice to uninstall compromised updates and reset passwords. This incident highlights the dangers of supply-chain attacks and the need for stronger security measures in extension management.

https://www.kaspersky.com/blog/chrome-extension-malicious-updates-and-mitigations/52871/