Supply chain attack hits Chrome extensions, could expose millions

• lift API keys,
• session cookies,
• other authentication tokens from websites such as ChatGPT and Facebook for Business.

In the first place Sekoia examined the infrastructure used for the wide-scale phishing campaign targeting devs. And traced it back to similar attacks as far back as 2023 with “high confidence.” The latest known campaign activity occurred on December 30, 2024, however.

In the second place, California-based Cyberhaven, which makes a cloud-based data protection tool, was among the victims. The company was one of the unfortunate ones to detect the compromise over the holiday period on Boxing Day 2024. A discovery that was widely reported at the time.

Potentially affected Chrome extensions

Booz Allen Hamilton, who analyzed the incident at Cyberhaven. And backed up the vendor’s suspicions that it was part of a wider campaign. Its accompanying report [PDF] to the Cyberhaven analysis revealed a long list of other extensions. It believes were likely affected, taking the potential number of affected end users into the millions. Sekoia published a less comprehensive list in its research, although the same extensions appear on both lists.

In the first place a number of the potentially affected extensions appear to have been pulled from the Chrome Web Store at the time of writing. (According to Booz Allen Hamilton’s report). The pages belonging to many of the others show they have been updated since Cyberhaven’s incident. Even that very few have publicly acknowledged an incident.

One outlier was Reader Mode, whose founder Ryzal Yusoff penned an open letter to its circa 300,000 users, informing them of a December 5 breach.

“On December 5, 2024, our developer account was compromised due to a phishing email that mimicked official  communications,” said Yusoff. “This breach allowed unauthorized parties to upload malicious versions of the Reader Mode extension (1.5.7 and 1.5.9) to the Chrome Web Store. The attack was discovered on December 20, 2024, after Google issued warnings identifying phishing attempts linked to this breach.

“The malicious versions of the extension may have included unauthorized scripts designed to collect user data or perform other harmful actions. If you installed or updated the Reader Mode extension between December 7 and December 20, 2024, your browser may have been affected.”

Jaime Blasco, co-founder and CTO at Austin-based Nudge Security, also named some extensions in a series of online posts he suspected were compromised, many of which also appeared in Booz’s report.

Chrome support impersonation

In the first place the attacker targeted dev teams with phishing emails seemingly from Chrome Web Store Developer Support. It mimicked official communication, according to Yusoff and Sekoia.

The sample email, which appears in the report, shows the warnings that extensions may be pulled from Chrome over fake rule violations, such as unnecessary details in the extension’s description.

Then, the victims were lured into clicking a link disguised as an explanation of Chrome Web Store policies. The link led to a legitimate Google Accounts page, where they were prompted to approve access for a malicious OAuth app. Once developers granted the app permission, the attacker gained everything needed to upload compromised versions of their extensions to the Chrome Web Store.

The researchers said it’s likely the devs’ emails were gathered from the Chrome Web Store, where such information may be accessible.

Probing the infrastructure

Using the two domains associated with the phishing emails, Sekoia uncovered the other domain names used in this campaign. And those likely involved in previous attacks by the same miscreants.

The domain names used as the attacker’s command and control (C2) servers were hosted at just two IP addresses. And using passive DNS resolutions, the researchers believe they uncovered possibly all the domains that were compromised in the campaign.

Sekoia said it was “straightforward” to uncover the domain names used in the latest attack and the ones used in 2023. Every time they used the same registrar (Namecheap), and the DNS setups and TLS configs were consistent.

“The domain naming convention and their creation dates indicate that the attacker’s campaigns have been active since at least December 2023”.

Sekoia wrote in a blog post, for example:

“It is possible that the websites redirecting to allegedly malicious Chrome extensions were promoted through SEO poisoning or malvertising.

As a matter of fact. “Sekoia analysts believe that this threat actor has specialized in spreading malicious Chrome extensions to harvest sensitive data. At the end of November 2024, the attacker shifted his modus operandi from distributing his own malicious Chrome extensions via fake websites to compromising legitimate Chrome extensions by:

• phishing emails,
• malicious OAuth applications,
• and malicious code

injected into compromised Chrome extensions.” ®