Malicious set Google Chrome Extensions designed to monitor browsing activity have been installed on over 1.4 million devices, researchers said.
As described in blog post (opens in a new tab) from security company McAfee, the purpose of the scam is to modify browser cookies every time they visit e-commerce website, thus charging the operator a partner fee for all purchases.
While two extensions labeled “Netflix Party” have now been removed from the official expansion market, McAfee says the others are still available for download.
Chrome extension scam
While malicious extensions do not pose a direct security risk – they are not intended to exfiltrate sensitive data or installations malicious software loads – are a gross violation of privacy.
As shown by the growing popularity VPN services and other solutions designed to conceal web activity, today’s web users are increasingly reluctant to part with their browsing data – and especially, as you might imagine, under these circumstances.
What makes this scam particularly hard to spot is the fact that all extensions serve a legitimate purpose, in addition to being the basis of the affiliate revenue trick. They are also generally well rated, which leaves potential victims with little sign of the scam taking place under their noses.
“The extensions offer various features, such as allowing users to watch Netflix programs, website coupons together, and take screenshots of the website,” explained McAfee.
“Extension users are unaware [the malicious functionality] and the privacy risk of any visited website that is sent to the extension authors ‘servers.’
Meanwhile, in an attempt to evade detection by analysts, operators programmed some extensions to start messing with browser cookies a few weeks after the installation date.
Chrome users who find that they have installed offensive extensions should perform a manual uninstall immediately.
List of malicious extensions:
- Netflix party
- Netflix Party 2
- FlipShop – price tracking extension
- Capture the full screen of the page – screenshot
- Flash AutoBuy for sale