Cybersecurity firm’s Chrome extension hijacked to steal users’ data
At least five Chrome extensions were compromised in a coordinated attack where a threat actor injected code that steals sensitive information from users.
One attack was disclosed by Cyberhaven, a data loss prevention company that alerted its customers of a breach on December 24 after a successful phishing attack on an administrator account for the Google Chrome store.
Among Cyberhaven’s customers are Snowflake, Motorola, Canon, Reddit, AmeriHealth, Cooley, IVP, Navan, DBS, Upstart, and Kirkland & Ellis.
The hacker hijacked the employee’s account and published a malicious version (24.10.4) of the Cyberhaven extension, which included code that could exfiltrate authenticated sessions and cookies to the attacker’s domain (cyberhavenext[.]pro).
Cyberhaven’s internal security team removed the malicious package within an hour since its detection, the company says in an email to its customers.
Cyberhaven, a thing we've never heard about before until about 2 minutes ago, that does something with cybersecurity and lists it's biggest customers on it's website, was compromised. It resulted in a web-browser-based supply chain attack. pic.twitter.com/fNLFqUqQ9K
— vx-underground (@vxunderground) December 27, 2024
A clean version of the extension, v24.10.5 was published on December 26. Apart from upgrading to the latest version, users of the Cyberhaven Chrome extension are recommended to revoke passwords that aren’t FIDOv2, rotate all API tokens, and review browser logs to evaluate malicious activity.
More Chrome extensions breached
Following Cyberhaven’s disclosure, Nudge Security researcher Jaime Blasco took the investigation further, pivoting from the attacker’s IP addresses and registered domains.
There is code to receive commands from the malicious domain: pic.twitter.com/TawMBXDwhM
— Jaime Blasco (@jaimeblascob) December 27, 2024
According to Blasco, the malicious code snippet that let the extension receive commands from the attacker was also injected around the same time in other Chrome extensions:
- Internxt VPN – Free, encrypted, unlimited VPN for secure browsing. (10,000 users)
- VPNCity – Privacy-focused VPN with AES 256-bit encryption and global server coverage. (50,000 users)
- Uvoice – Rewards-based service for earning points through surveys and providing PC usage data. (40,000 users)
- ParrotTalks – Information search tool specializing in text and seamless note-taking. (40,000 users)
Blasco found more domains that point to other potential victims but only the extensions above were confirmed to carry the malicious code snippet.
Users of these extensions are recommended to either remove them from the browser or upgrade to a safe version published after December 26 after making sure that the publisher has learned about the security issue and fixed it.
If unsure, it would be better to uninstall the extension, reset important account passwords, clear browser data, and reset browser settings to their original defaults.
