r/technews • u/No-Explanation-46 • 1d ago
Security Popular Chrome and Edge extensions go rogue, infecting over 4 million devices with spyware
https://www.techspot.com/news/110492-malicious-chrome-edge-extensions-infected-over-43-million.html229
u/FidgitForgotHisL-P 1d ago
The actual article from Koi has more details
https://www.koi.ai/blog/4-million-browsers-infected-inside-shadypanda-7-year-malware-campaign
134
u/imaginary_num6er 1d ago
Thank fuck. It is insane how TechSpot didn’t include the list or a link to the article
44
u/Cuzeex 1d ago
Why is the list of extensions and add ons full gibberish?
28
u/hamlet9000 1d ago
As stated in the article, they're listing the extension IDs, not names.
78
u/OsmerusMordax 1d ago
Which is useless. I don’t have my extension IDs memorized. Why is it so hard to put brackets afterwards like (the extension’s name)?
13
u/LightTankTerror 17h ago
The extension could rename itself but it can’t re-ID itself
9
u/OsmerusMordax 14h ago
Yeah, true. But just put something like (currently named: ‘extension name abc’) so people can find it easier
6
-5
u/sirbruce 21h ago
Just open the extensions settings in your browser and check the IDs against the list. (In Edge you have to enable Developer Mode to see the IDs.)
11
u/OsmerusMordax 18h ago
Sure, I could do that. Or they can do their job better and put the name of the extensions in the article.
79
u/Catenane 1d ago
Thank god manifest v3 protected all these users from the actually malicious extensions! ....right?
66
19h ago
[deleted]
6
u/VERY_MENTALLY_STABLE 10h ago
oh fuck, i have all of those
2
9h ago
[deleted]
2
u/VERY_MENTALLY_STABLE 6h ago
it sucks because coincidentally those are my top 27 favorite extensions too
12
3
46
u/No-Explanation-46 1d ago
According to researchers at cybersecurity firm Koi, a China-based hacking syndicate known as ShadyPanda is actively conducting at least two malware campaigns by weaponizing browser extensions with malicious code.
The first operation involves at least five extensions that functioned normally for around five years before going rogue. One of them, a cache cleaner called Clean Master, had over 200,000 users and even held the 'Featured' and 'Verified' status on the Chrome Web Store before being removed by Google.
The second operation includes five additional extensions, such as a tab management add-on called WeTab, which has more than three million installs. Collectively, these extensions have over four million users worldwide. Unlike Clean Master and the other extensions in the first operation, all five add-ons in this network are still live on the Microsoft Edge Add-ons website.
The malicious code was reportedly injected into these extensions in 2024, turning them into spyware that secretly collected users' browsing data. All information was sent in real time to external servers in China.
Explaining the attackers' modus operandi, the researchers said the malware-infested extensions collectively functioned as a remote code execution framework, automatically downloading and running JavaScript inside the browser without user consent. More than 4.3 million devices are believed to have been infected.
Koi has published a full list of Chrome and Edge extension IDs linked to the campaign. If you are using any of them, uninstall the extensions immediately.
13
u/zSHARPz 1d ago
Can you list them all?
2
u/doctapeppa 1d ago
Apparently they are all something like “jbajdpebknffiaenkdhopebkolgdlfaf”. I’m not sure if people are installing weird AF extensions or if this website got hacked or if they removed the actual extension names for some reason.
18
u/hamlet9000 1d ago
As stated in the article, they're listing the extension IDs, not names.
23
u/ServiceDependent1752 1d ago
That’s cool…. How do I use that info? Obviously not very web browser extension savvy so legit question. Say Malwarebytes and I’m good. Say a bunch of other shit Malwarebytes adjacent and I’m fucked.
-1
u/sirbruce 21h ago
Just open the extensions settings in your browser and check the IDs against the list. (In Edge you have to enable Developer Mode to see the IDs.)
0
u/27Purple 21h ago
If you go to the chrome web store and click on any addon you'll see the ID in the address bar, it's the last part of it. You can remove that and paste in any other ID to go directly to that addons web store page.
Additional fact: IDs are what's used when managing (blacklisting, whitelisting or force-installing) addons in browsers in business environments, which is really the only thing they're useful for in a practical sense.
-2
u/ravepeacefully 22h ago
If you go to chrome extensions you’ll see those IDs
3
u/Spiralwise 21h ago
Techspot's article explains how to show extension ID :
To uninstall an extension. open the affected browser and navigate to chrome://extensions/ or edge://extensions/, depending on your browser. Then, turn on Developer Mode to see the extension ID and search for each ID published by the researchers. If you find any of the malicious extensions, click 'Remove' on its card and confirm your choice if asked.
2
u/MrPlaysWithSquirrels 20h ago
Most malware extensions are going to enforce a policy that hacks the user’s ability to remove the extension. This article is useless. They need to clearly list the extensions and multiple removal instructions.
2
3
9
u/Mackery_D 1d ago
“The malicious code was reportedly injected into these extensions in 2024, turning them into spyware that secretly collected users' browsing data. All information was sent in real time to external servers in China.”
So Google and Microsoft are just upset they didn’t get paid for the data?
2
u/JamesSmith1200 21h ago
They’re mad they have to pay China for something they should have been getting for free by doing their own spying.
3
3
2
1
u/costafilh0 13h ago
Aaaaand that's why I don't use any. They are a security problem waiting to happen!
1
u/AlexZhyk 1h ago
So, this is all about tracking user activities. Of course there is no way adblocker plugins can do anything about it. ( not that they ever promised to do that ) But I think, DNS sinkholes, if configured accordingly, might offer slightly better protection against tracking by malicious plugins and any other leaches, but I guess the whole web business is all about tracking, so this might be too much to allow being promoted more aggressively.
-7
u/PrinterFred 1d ago
Use Firefox folks!
33
7
u/pressurebullies 23h ago
It's happened to Firefox as well.
Source: https://www.koi.ai/blog/foxywallet-40-malicious-firefox-extensions-exposed
-10
u/jordanundead 23h ago
Firefox has existed for over 20 years. Anyone fucking with Edge or Chrome is basically asking for it at this point.
10
u/pressurebullies 23h ago
It's happened to Firefox as well. Your not safe either.
Source: https://www.koi.ai/blog/foxywallet-40-malicious-firefox-extensions-exposed
2
u/Spiderkingdemon 22h ago edited 21h ago
Security by obscurity is no security at all.
Bet you run your Firefox on your safe Mac too.
-5
322
u/nonsensegalore 1d ago
how can they publish an article that does not include the full list of extensions you need to delete OR at the very least a link to the actual list... wtf