Loading story…
Google is preparing a Chrome security feature that blocks extensions installed through enterprise policy from overriding the New Tab page or changing the default search engine on unmanaged Windows and macOS devices. The change targets malware that abuses local policy keys to force-install administrator-controlled extensions, hijack browser behavior, and make removal difficult for users by presenting the extensions as managed.
According to reports tied to Chromium Gerrit changes, Chrome will cancel installation of these override extensions, add their IDs to a blocked list, and stop retrying downloads during later policy checks. Google also plans to stop manually installed extensions from being converted into locked policy-controlled ones and to automatically remove affected hijacker extensions if a device loses trusted management status, while keeping an enterprise policy escape hatch for legitimate managed environments once the feature is approved and enabled by default.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Google is developing a Chrome security feature for unmanaged Windows and macOS devices that would block policy-installed extensions from overriding the New Tab page or changing the default search engine. The work is described as still under review in Chromium Gerrit and not yet shipped in stable Chrome.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcescworld.com
Open sourceghacks.net
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple **malicious browser-extension** campaigns abusing official extension stores and search-driven lures to compromise enterprise users. Huntress documented a Chrome Web Store extension, **“NexShield – Advanced Web Guardian”** (a near-clone of *uBlock Origin Lite*), distributed via search/advertising redirection and designed to intentionally “freeze” the browser and present a fake **CrashFix** security prompt that instructs users to paste and run commands via `Win + R`; this social-engineering step results in installation of a previously undocumented Windows RAT dubbed **ModeloRAT** on domain-joined endpoints. Reporting also tied the delivery to a traffic distribution system (**KongTuke**, also tracked as **404 TDS/TAG-124** and other aliases) used to profile victims and route them to payload delivery infrastructure that has been leveraged by other criminal operations, including ransomware affiliates. Separately, Socket.dev analysis described **five coordinated Chrome extensions** targeting enterprise SaaS platforms (**Workday, NetSuite, SuccessFactors**) to enable account takeover via **session hijacking**, including continuous token theft and **bidirectional cookie injection** that can bypass MFA by replaying stolen session cookies. In parallel, Malwarebytes reported “sleeper” extension campaigns attributed to **DarkSpectre** (including **GhostPoster** and **ShadyPanda**) that turned previously benign extensions malicious after updates and used **steganography** (JavaScript hidden in extension images) to evade detection across **Edge, Chrome, and Firefox**, with large download counts and long dwell time. A separate Nextron Systems report described a related distribution pattern—malicious “free converter” apps promoted via **malicious Google ads** and made to look legitimate with **code-signing certificates**—highlighting the broader trend of search/advertising-driven initial access leading to persistent RAT deployment, though it is not the same extension-specific incident as the NexShield/CrashFix chain.
Jun 29, 2026
Researchers reported a coordinated operation involving at least five **malicious Chrome extensions** masquerading as productivity or security tools, designed to **hijack enterprise web sessions** by stealing authentication cookies/session tokens. The extensions targeted business platforms such as **Workday, NetSuite, and SAP SuccessFactors**, where possession of a valid session token can enable access without re-entering credentials; telemetry indicated some variants attempted to **exfiltrate cookies as frequently as every 60 seconds**. Prior to takedown requests to Google, the campaign was estimated to have reached **2,300+ installs**. One variant, **Software Access**, was described as particularly advanced because it supported **bidirectional cookie injection**—using Chrome APIs such as `chrome.cookies.set()` to implant stolen session cookies into an attacker-controlled browser, effectively recreating an authenticated session. Investigators noted the extensions shared **identical infrastructure patterns** despite being published under different names (including multiple under “databycloud1104”), supporting attribution to a single coordinated actor. Recommended mitigations included stricter enterprise controls over browser extensions (vetting and limiting permissions, especially cookie access), removing unnecessary add-ons, and monitoring for anomalous session activity and extension behavior to detect session hijacking attempts earlier.
Jun 29, 2026
Security researchers reported multiple risks tied to **AI-themed browser extensions** in the Chrome/Edge ecosystem, including active malicious campaigns. Malwarebytes identified **16 malicious extensions** (15 Chrome, 1 Edge) masquerading as ChatGPT “enhancers” that **steal ChatGPT session tokens**, enabling attackers to take over accounts and access conversation history and metadata; the extensions also exfiltrate additional telemetry (e.g., extension version/language and usage details) to help attackers profile victims and maintain longer-term access. Separately, Varonis described a new **malware-as-a-service** offering called **“Stanley”** that claims to reliably get **phishing-capable Chrome extensions** through Chrome Web Store review, using full-screen `iframe` overlays to present attacker-controlled login pages while the address bar continues to show the legitimate domain; it also advertises auto-install support across Chrome/Edge/Brave, a management panel, geo/IP targeting, and frequent C2 polling. In parallel with these overtly malicious cases, an Incogni study of **442 AI-powered Chrome extensions** found broad privacy and security exposure from over-privileged extensions (e.g., script injection and deep page access) and extensive data collection (52% collecting user data), highlighting that even popular tools (e.g., **Grammarly** and **QuillBot**) can present significant privacy risk due to the scope of permissions and data categories collected.
Jun 29, 2026