chushpan
Professional
- Messages
- 661
- Reaction score
- 449
- Points
- 63
A newly developed “polymorphic” attack allows malicious Chrome extensions to morph into other browser extensions, including password managers, cryptocurrency wallets, and banking apps, to steal sensitive information.
The attack was developed by SquareX Labs, which warns of its practicality and feasibility on the latest version of Chrome. The researchers responsibly reported the attack to Google.🗞 SquareX uses an example of an AI marketing tool that offers promised functionality by tricking victims into installing and pinning the extension to their browser.
To get a list of other installed extensions, the malicious extension abuses the 'chrome.management' API, which it gained access to during installation.
If the malicious extension does not have this permission, SquareX claims that there is a second, more stealthy way to achieve the same thing, involving injecting resources into web pages visited by the victim.
The malicious script attempts to download a specific file or URL unique to the target extensions, and if it downloads, it can be concluded that the extension is installed.
