More than two dozen malicious programs posing as third-party extensions for top social media sites have been downloaded some 3 million times, surreptitiously redirecting users to phishing sites, displaying advertisements, and stealing data, antivirus firm Avast reports.
The cybercriminals behind the 28 third-party extensions camouflaged the malicious functionality as a variety of add-on features — such as video downloaders and direct message apps — for social media sites, including Facebook, Instagram, SoundCloud, and Vimeo. The extensions are written in JavaScript, can exfiltrate information on the user, and can download and execute additional malicious code, Avast stated in a report published today.
The company found no evidence of the extensions being used as a bridge into corporate networks, but attackers may have the ability to download and inject arbitrary JavaScript into any tab, says Jan Rubín, a malware researcher at Avast.
"This could be used to gather credentials and other sensitive corporate data from the websites visited by the victim," he says. "We are preparing a technical blog post with more technical information and IoCs, but for now, we can share the ... malicious domains."
The malicious extensions are the latest attempt by cybercriminals to hide code in add-ons for popular browsers. In February, independent researcher Jamila Kaya and Duo Security announced they had discovered more than 500 Chrome extensions that infected millions of users' browsers to steal data. In June, Awake Security reported more than 70 extensions in the Google Chrome Web store were
Support the originator by clicking the read the rest link below.
