These 108 Malicious Chrome Extensions Are Stealing Google and Telegram Data Be careful which extensions you install in Chrome. Apr 16,

[Condobloke]

These 108 Malicious Chrome Extensions Are Stealing Google and Telegram Data

Be careful which extensions you install in Chrome.

au.lifehacker.com

108 Chrome Extensions Linked to Data Exfiltration and Sessio...

Campaign of 108 extensions harvests identities, steals sessions, and adds backdoors to browsers, all tied to the same C2 infrastructure.

socket.dev

 

[KGIII]

It's important to keep things updated. This sort of stuff isn't unique to Chrome.

https://cybernews.com/security/firefox-extensions-hide-malware-in-icons-infect-thousands/

Yup. Firefox (and derivatives) were exploited by icons. I'm pretty sure I hadn't seen that before.

(That's just the most recent.)
There's also stuff like this:

Multiple Vulnerabilities in Mozilla Products Could Allow for Arbitrary Code Execution

<p>Multiple vulnerabilities have been discovered in Mozilla products, the most severe of which could allow for arbitrary code execution.</p><p> </p><ul><li>Mozilla Firefox is a web browser used to access the Internet.</li><li>Mozilla Firefox ESR is a version of the web browser intended to be...

www.cisecurity.org

If you're using Firefox or Firefox derivatives, you face the same issues. If you use a Firefox derivative, you're potentially even further behind the curve. Not only do they have to wait for Mozilla to patch the software, but they also have no knowledge of the exploits until Mozilla releases the fixes and information about said exploits. Using a derivative of Firefox just means you're waiting even longer for the security fixes to be applied.

 

[kc1di]

Use as few extensions as you can get away with. I won't install one unless it significantly adds to my work flow or help me do things I need to do. Be careful of what you add on.

 

[ron.alan]

Are these exploits something that the website virus total would detect?

 

[kc1di]

Are these exploits something that the website virus total would detect?

No not really they are either poorly design web extensions to chrome or FF or they are extensions that were purposefully designed to mine information or worse install back door and such.

 

[lomszz]

I have only 2 extensions, used to be only 1 but recently added malwarebytes. Ublock has been my essential a long time.

Never have seen reason to use more than 1 or 2, maybe because you can't blindly trust extensions.

 

[APTI]

These 108 Malicious Chrome Extensions Are Stealing Google and Telegram Data

Be careful which extensions you install in Chrome.

au.lifehacker.com

108 Chrome Extensions Linked to Data Exfiltration and Sessio...

Campaign of 108 extensions harvests identities, steals sessions, and adds backdoors to browsers, all tied to the same C2 infrastructure.

socket.dev

stealing data from google? what is google getting jealous? They are the biggest data thieves on the planet.

 

[peterjamess]

Thanks for the heads-up. It's surprising how many people install extensions without checking who published them or what permissions they're asking for. Definitely worth reviewing the extensions you already have installed.