Loading story…
Cyberhaven said attackers compromised its Google Chrome extension publishing process and pushed a malicious update that could steal credentials and other sensitive browser data from affected users. Reporting indicates the trojanized extension targeted logged-in sessions and authentication material, with the incident drawing attention because Cyberhaven is itself a cybersecurity company. The compromise affected the company's browser extension distributed through the Chrome Web Store, turning a trusted security tool into a delivery mechanism for data theft.
Follow-up reporting and incident write-ups said the malicious version was removed and replaced after discovery, while customers were urged to identify impacted endpoints, revoke exposed credentials, rotate passwords, and review browser activity for signs of session or token theft. The case highlights a software supply-chain style attack against browser extensions, where attackers abused a vendor's update channel to distribute malware under the guise of a legitimate signed release.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
Security reporting said the same operation had compromised at least 35 Chrome extensions affecting roughly 2.6 million users. The reports also described a fake Chrome Web Store policy email lure that tricked developers into authorizing a malicious OAuth app, enabling attackers to publish tampered extensions aimed at stealing Facebook-related tokens and account data.
Cyberhaven publicly confirmed that its Chrome extension had been compromised and advised customers to rotate passwords, revoke tokens, and review logs for suspicious activity. Security reporting also highlighted that the campaign may have affected other Chrome extensions through similar publisher-account compromises.
Cyberhaven identified the unauthorized extension update, revoked the attacker's access, and removed the malicious version from distribution. The company began incident response and notified customers about the compromise.
Using the compromised publisher account, the attacker published a malicious version of Cyberhaven's Chrome extension that was designed to exfiltrate sensitive data, including authenticated sessions and credentials from affected users. Reporting indicates the malicious update was available through the Chrome Web Store before it was detected and removed.
Cyberhaven said the incident began when a threat actor successfully phished an employee and used the stolen credentials to access the company's Chrome Web Store publisher account. This access enabled the attacker to tamper with the Cyberhaven browser extension release process.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
7 references tracked. Mallory keeps watching after this page renders.
codeby.net
Open sourcecodeby.net
Open sourcecodeby.net
Open sourcebleepingcomputer.com
Open sourcesecureannex.com
Open sourcetechcrunch.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers compromised several legitimate Chrome extensions by phishing developers’ Google Account credentials and then using those accounts to push malicious updates through the Chrome Web Store. Proofpoint reported that affected extensions included **Web Developer** (`0.4.9`), **Chrometana**, **Infinity New Tab**, **CopyFish**, **Web Paint**, and **Social Fixer**, with **TouchVPN** and **Betternet VPN** also likely impacted. Because the updates came from trusted publisher accounts, the malicious code was delivered to existing users as if it were a normal extension release. The injected code delayed execution after installation, retrieved additional payloads from **DGA-generated domains**, and then manipulated browser activity to hijack traffic, replace advertisements, display fake repair alerts, and redirect victims to affiliate programs. Researchers also identified credential-theft components in the campaign, including scripts intended to steal and exfiltrate **Cloudflare** credentials, showing that the operation combined ad fraud, traffic interception, and account compromise in a broad extension hijacking spree.
Aug 14, 2026
Security researchers reported a surge in **malicious Chrome extensions** abusing high-privilege browser permissions to steal credentials and hijack authenticated sessions. LayerX identified at least **16 ChatGPT-related extensions** that mimic legitimate productivity tools and brands, then inject scripts into `chatgpt.com` to monitor outbound web requests and **exfiltrate authorization details and session tokens** to attacker-controlled infrastructure. With stolen tokens, attackers can impersonate victims’ ChatGPT sessions and potentially access connected data sources (e.g., integrations with *Slack* and *GitHub*), expanding impact beyond the AI service itself. Separately, Varonis documented a **malware-as-a-service** browser-extension toolkit dubbed **Stanley** being sold on Russian-language cybercrime forums, marketed to enable large-scale credential theft by **showing a phishing site while the URL bar continues to display the legitimate domain**. The toolkit uses a web-based control panel to configure per-victim “source” (legitimate) and “target” (phishing) URLs, then overlays a full-screen iframe to spoof the destination site; the seller also claims “guaranteed” placement in the **Chrome Web Store**, increasing the likelihood of user installation and enterprise exposure.
Jun 29, 2026
Researchers identified a campaign involving **19 malicious browser extensions** distributed through the Google Chrome Web Store and Microsoft Edge Add-ons marketplace, with reported installations exceeding **2.3 million users**. Fourteen extensions were published as apparently legitimate software, while five were acquired from their original developers and later updated with malicious functionality, leaving users unaware that ownership and code had changed. The extensions contacted command-and-control infrastructure to retrieve replaceable modules, bypassed Content Security Policy controls, and injected code into targeted web pages. They could steal credentials, payment data, Facebook and LinkedIn information, browsing history, cryptocurrency assets, and hardware-wallet seed phrases; some also overlaid pages with **ClickFix** lures that impersonated browser-update notices and persuaded victims to run malicious commands, potentially extending compromise beyond the browser.
Sep 26, 2026