Malware in Google Chrome and Microsoft Edge extensions: Avast

Cybersecurity firm Avast has identified malware hidden in at least 28 third-party Google Chrome and Microsoft Edge extensions that may have affected 3 million users worldwide.
Online protection
The Chrome and Edge extensions are associated with some of the world’s most popular platforms like Instagram, Facebook and Google Chrome.

The malware has the functionality to redirect user’s traffic to ads or phishing sites and to steal people’s personal data, such as birth dates, email addresses, and active devices, Avast’s threat Intelligence researchers said in a blog post.

According to the app stores’ download numbers, around 30 lakh people may be affected worldwide.

The extensions which aid users in downloading videos from these platforms include Video Downloader for Facebook, Vimeo Video Downloader, Instagram Story Downloader, VK Unblock, and other browser extensions on the Google Chrome Browser, and some on Microsoft Edge Browser.

At this moment, the infected extensions are still available for download.

Avast said it has contacted the Microsoft and Google Chrome teams to report them and the companies confirmed they are currently looking into the issue.

The researchers identified malicious code in the Javascript-based extensions that allows the extensions to download further malware onto a user’s PC.

“Our hypothesis is that either the extensions were deliberately created with the malware built in, or the author waited for the extensions to become popular, and then pushed an update containing the malware,” said Jan Rubin, Malware Researcher at Avast.

“It could also be that the author sold the original extensions to someone else after creating them, and then the buyer introduced the malware afterwards.”

Users have reported that these extensions are manipulating their internet experience and redirecting them to other websites.

The Avast Threat Intelligence team started monitoring this threat in November, but believes that it could have been active for years without anyone noticing.

There are reviews on the Chrome Web Store mentioning link hijacking from as far back as December 2018, Jan Rubin said.

Related News

Latest News

Latest News