Socket uncovers malicious Firefox extensions spoofing Phantom, Jupiter, and Bitget. These malicious Firefox wallet extensions steal seed phrases.
Related Posts:
Yoba Malware Campaign Sideloads Payloads Through Signed OpenAI and Anthropic Binaries
Fake FedEx Tax Invoice PDFs Deliver Fileless Sirius Backdoor to Windows Systems
Brazilian Magecart Group Hits Convertr Ecommerce Platform in Plausible Analytics Supply Chain Attack
The post Fake Phantom, Jupiter, and Bitget Firefox Extensions Steal C
60 OffiDocs Chrome extensions with 2.3M installs secretly send browsing URLs. See how these spying Chrome extensions work and how to stay safe.
Related Posts:
Keystone Wallet Data Breach Exposes Customer Orders
PingCAP Data Breach Exposes TiDB Cloud Customer Records and Source Code
Smart TV ACR Tracking Study Finds Failed Opt-Outs and 57 Million Exposed Viewing Records
The post OffiDocs Chrome Extensions With 2.3 Million Installs Caught Harvesting Browsing URLs appeared first on Daily CyberSe
Socket found 16 malicious Firefox extensions posing as Rabby and OKX. These crypto wallet stealers grabbed seed phrases. Here is what to do.
Related Posts:
The Silent Threat of Midnight Mimosa Malware
Phishing Campaign Abuses Microsoft Power BI to Install Rogue ScreenConnect Clients
Rogue AI Agents Hijacked urlquery Scan Browsers to Reach Russian Bankruptcy Records
The post 16 Fake Rabby and OKX Firefox Extensions Stole Crypto Wallet Recovery Phrases appeared first on Daily CyberSecurity.
Socket links GlassWorm VS Code themes to malicious VS Code extensions with 8,000+ installs, including a Coca-Cola theme. See how to check yours.
Related Posts:
Moroccan Intelligence Deploys Vast Surveillance Panopticon
DragonForce Backdoor Adds MQTT Fallback to Microsoft Teams TURN Command Channel
New 2CLoader Malware Delivers Vidar and Remus Infostealers While Dodging Sandboxes
The post Socket Links Popular VS Code Color Themes to the GlassWorm Supply Chain Campaign appeared first on Daily C
A Chrome extension popup freeze bug on macOS delays 1Password and other extensions by minutes. Google has flagged it high priority but has no fix yet.
Related Posts:
Apple Introduces the iOS 27 Auto Lock Feature
Trump Mandates Super Intelligence to Replace AI Terminology
iPhone 18 Pro Face ID Failures Trigger System Restarts
The post Chrome Extension Popups Freeze for macOS Users appeared first on Daily CyberSecurity.
Learn how Brazilian KREMLIN banking malware steals credentials using fake browser extensions. Elastic Security Labs details the KREMLIN banking malware.
Related Posts:
LLM-Generated PhantomRaven Information Stealer Discovered
Mantax Otax Android Malware: Spyware Meets Ransomware
SloppyRAT Malware Analyzed in Ransomware Attacks
The post KREMLIN Banking Malware Targets Brazilian Banks appeared first on Daily CyberSecurity.
Security researchers found 150 lookalike Open VSX extensions published under trusted names, highlighting how extension marketplaces can expose developer credentials, source code, and CI/CD systems to supply-chain risk.
The post 77 Counterfeit Open VSX Extensions Collected Developer and CI/CD Data appeared first on TechRepublic.
Security researchers found 150 lookalike Open VSX extensions published under trusted names, highlighting how extension marketplaces can expose developer credentials, source code, and CI/CD systems to supply-chain risk.
Google is developing Chrome protections that could block policy-installed extensions from hijacking New Tab pages and search settings on personal devices.
The post Chrome to Block Policy-Abusing Extensions on Personal Devices appeared first on TechRepublic.
Google is developing Chrome protections that could block policy-installed extensions from hijacking New Tab pages and search settings on personal devices.
Researchers say a Claude for Chrome flaw lets rogue extensions trigger Gmail, Docs, and Calendar tasks, with greater risk in unattended mode.
The post Claude for Chrome Flaw Puts Gmail at Risk From Rogue Extensions appeared first on TechRepublic.
Microsoft found a fake Perplexity AI Chrome extension that rerouted searches through attacker servers. Here’s what users should check now.
The post Microsoft Warns: Fake Perplexity Extension Abused Chrome Search Features appeared first on TechRepublic.
How many browsers extensions do you have running? Most enterprise users have at least one and seven out of ten have seen an extension expand its permissions over the last 12 months—with AI extensions being the worst offenders…by sixfold.
The post Over Permissive and Proliferating, AI-Driven Browser Extensions Create Security Blindspots appeared first on Security Boulevard.
How many browsers extensions do you have running? Most enterprise users have at least one and seven out of ten have seen an extension expand its permissions over the last 12 months—with AI extensions being the worst offenders…by sixfold.
Extensions installed on almost 1 million devices have been overriding key security protections to turn browsers into engines that scrape websites on behalf of a paid service, a researcher said.
The 245 extensions, available for Chrome, Firefox, and Edge, have racked up nearly 909,000 downloads, John Tuckner of SecurityAnnex reported. The extensions serve a wide range of purposes, including managing bookmarks and clipboards, boosting speaker volumes, and generating random numbers. The common thre
Extensions installed on almost 1 million devices have been overriding key security protections to turn browsers into engines that scrape websites on behalf of a paid service, a researcher said.
The 245 extensions, available for Chrome, Firefox, and Edge, have racked up nearly 909,000 downloads, John Tuckner of SecurityAnnex reported. The extensions serve a wide range of purposes, including managing bookmarks and clipboards, boosting speaker volumes, and generating random numbers. The common thread among all of them: They incorporate MellowTel-js, an open source JavaScript library that allows developers to monetize their extensions.
Intentional weakening of browsing protections
Tuckner and critics say the monetization works by using the browser extensions to scrape websites on behalf of paying customers, which include AI startups, according to MellowTel founder Arsian Ali. Tuckner reached this conclusion after uncovering close ties between MellowTel and Olostep, a company that bills itself as "the world's most reliable and cost-effective Web scraping API." Olostep says its service “avoids all bot detection and can parallelize up to 100K requests in minutes.” Paying customers submit the locations of browsers they want to access specific webpages. Olostep then uses its installed base of extension users to fulfill the request.
As many of us celebrated the year-end holidays, a small group of researchers worked overtime tracking a startling discovery: At least 33 browser extensions hosted in Google’s Chrome Web Store, some for as long as 18 months, were surreptitiously siphoning sensitive data from roughly 2.6 million devices.
The compromises came to light with the discovery by data loss prevention service Cyberhaven that a Chrome extension used by 400,000 of its customers had been updated with code that stole their sen
As many of us celebrated the year-end holidays, a small group of researchers worked overtime tracking a startling discovery: At least 33 browser extensions hosted in Google’s Chrome Web Store, some for as long as 18 months, were surreptitiously siphoning sensitive data from roughly 2.6 million devices.
The compromises came to light with the discovery by data loss prevention service Cyberhaven that a Chrome extension used by 400,000 of its customers had been updated with code that stole their sensitive data.
’Twas the night before Christmas
The malicious extension, available as version 24.10.4, was available for 31 hours, from December 25 at 1:32 AM UTC to Dec 26 at 2:50 AM UTC. Chrome browsers actively running Cyberhaven during that window would automatically download and install the malicious code. Cyberhaven responded by issuing version 24.10.5, and 24.10.6 a few days later.
Entrar
