This was after a series of seemingly unrelated events in late October and early November that Cyberhaven employees were supposedly involved in. These events included the compromise of an AWS account and a phishing attempt against a Google developer. The malicious extension, which was published under a legitimate developer’s name, was downloaded by at least 10,000 users of Cyberhaven. It was discovered by Chrome’s security team on Dec. 12, and removed from the Web Store on Dec. 14. By the time it was removed, the malicious extension had caused a total of 15,000 compromised accounts to be identified. It is believed that the hackers may have stolen sensitive data from the affected users, including login credentials, credit card numbers, and other personal information. The attack was discovered by a cybersecurity researcher who noticed a suspicious pattern of downloads of the malicious extension. The researcher was able to track the extension’s activity and identify the malicious code. The attack highlights the importance of robust security measures in protecting against phishing attacks. It also underscores the need for better security practices, such as verifying the authenticity of software updates and extensions. The attack demonstrates the importance of the browser extension ecosystem in protecting users’ security. Google Chrome’s removal of the malicious extension and subsequent action against the hackers demonstrates the effectiveness of the company’s security measures. The attack also raises questions about the responsibility of software developers and extension creators. Should they be responsible for protecting their users’ data and preventing phishing attacks, or is it the responsibility of the browser providers and security companies? The attack raises concerns about the lack of accountability and oversight within the extension ecosystem. The attackers were reportedly caught by a cybersecurity researcher who noticed a suspicious pattern of downloads of the malicious extension.

When a user clicked on a malicious QR code, the extension would inject malicious code into the user’s browser, allowing the attack to gain access to the user’s Facebook account.

The Attack on Facebook Accounts via Poisoned Extensions

The attack targeted Facebook accounts of users of the poisoned extensions, specifically those who had installed the malicious extensions on their browsers. The attackers used a sophisticated technique to inject malicious code into the users’ browsers, allowing them to gain unauthorized access to the users’ Facebook accounts.

How the Attack Worked

The attack relied on a mouse click event listener that was specifically designed to look for QR code images related to Facebook’s 2FA mechanisms. When a user clicked on a malicious QR code, the extension would inject malicious code into the user’s browser. This malicious code would then allow the attackers to gain access to the user’s Facebook account. The malicious code would be injected into the browser through a technique called “DOM-based XSS” (Cross-Site Scripting). The attackers would then use the injected code to send a request to Facebook’s servers, which would authenticate the user’s account and grant access to the attackers. The attackers would then use the authenticated account to steal sensitive information, such as login credentials and personal data.

The Role of QR Codes in the Attack

QR codes played a crucial role in the attack.

These protections help prevent unauthorized access to user data.

Google Chrome’s Security Features

Protecting User Data

Google Chrome’s security features are designed to protect user data from unauthorized access.