Cybersecurity Alert: Malicious Code Found in Popular Browser Extensions

According to PANews, a security alert was issued by AabyssTeam's founder on the X platform, revealing that Cyberhaven, a security company, fell victim to a phishing email attack. This breach led to the insertion of malicious code into their browser extension, aiming to access users' browser cookies and passwords. Further analysis uncovered that multiple browser extensions, including Proxy SwitchyOmega (V3), were compromised. These affected extensions, available on the Google Store, have impacted 500,000 users and are currently under scrutiny. SlowMist founder Yu Jian shared the alert, explaining that the attack utilized an OAuth2 attack chain. By obtaining the 'extension publishing rights' of the 'target browser extension' developers, attackers released updates with backdoors. These updates could be automatically triggered each time the browser is launched or the extension is reopened, making the backdoor difficult to detect.