Google Chrome users have been warned to delete 16 “malicious” browser extensions that could lead on to a security threat and “fraud” by the hands of a prolific “threat actor.”
The extensions affect functionality involving screen capture, ad blocking, emoji keyboards and more, with a possible impact on at the least 3.2 million users, in keeping with GitLab Threat Intelligence, which first reported the threat.
The extensions inject code and harmful scripts into browsers, allowing hackers to steal user data and interact in search-engine fraud involving ad revenue, in keeping with Tom’s Guide.
After users granted permission to make use of them, the extensions, while legitimate, were infected with malicious updates that corrupted them.
Based on tech site Notebook Check, the attack was traced to developer accounts that unknowingly transferred control of extensions to the attackers, whose dangerous updates were available through official browser extension stores.
The damaging extensions include:
- Blipshot
- Emojis (Emoji Keyboard)
- Color Changer for YouTube
- Video Effects for YouTube and Audio Enhancer
- Themes for Chrome and YouTube Picture in Picture
- Mike Adblock für Chrome
- Super Dark Mode
- Emoji Keyboard Emojis for Chrome
- Adblocker for Chrome (NoAds)
- Adblock for You
- Adblock for Chrome
- Nimble Capture
- KProxy
- Page Refresh
- Wistia Video Downloader
- WAToolkit
The targeted extensions have already got been faraway from the Chrome Web Store, but users should manually delete them in the event that they are still installed on their browsers.
Tom’s Guide advises then using antivirus software to scan for malware or other viruses.
