These 30 Chrome Extensions Were All Breached, and Millions of Users Are Affected

Google Chrome users beware: 30 popular Chrome extensions have been hacked, exposing millions of users to data theft.

How are Chrome extensions hacked?

Chrome extension hacking started with a security firm’s browser extension breach. Cyberhaven announced that one of its employees fell victim to a phishing attack, which allowed the attackers to publish a compromised version of the extension.

Further investigation by another security company, Secure Annexfound another 29 compromised extensions using the same method, pointing to the same C&C servers used in the Cyberhaven attack.

Given the number of additional Chrome extensions discovered, it suggests that a wider campaign has been waged against browser extensions, which means the list could grow.

Which Chrome extensions are affected?

Fortunately, the Secure Annex team has compiled a Google Sheet to track affected Chrome extensions.

More easily, include the full name of each app, the affected version number, and whether the extension is still available. Also, it gives a total of the number of affected users – reaching more than 2.5 million users at the time of writing. Some of the more popular affected extensions include:

• Visual effects for Google Meet

• Cyberhaven Security Extension V3

• Player mode

• YesCaptcha Assistant

• Email Hunter

• Rewards Search Automator

• Bard AI Chat

• GraphQL Network Inspector

• Castorous

• Primus

Check out the full list at Secure Annex, and be aware that it could grow if more malicious extensions are discovered.

How to protect your data if you used an infected Chrome extension

First, remove any infected extensions. Deleting them will stop any other data loss. Also, if you don’t remove the outdated and infected version, the data theft could continue without you realizing it.

Next, you’ll want to pay attention to your online accounts. Pay attention to unexpected requests to change passwords, email account changes, and so on. If you notice anything strange, make sure to change your passwords and remove all infected extensions.