When you purchase through links on our site, we may earn an affiliate commission.Heres how it works.
As reported byBleepingComputer, the cybersecurity company SquareX Labs devised this new attack as a proof of concept.
From here, this list of installed extensions is then sent back to a hacker-controlled server.
If one of the targeted extensions like1Password is installed, the malicious extension then transforms to completely copy it.
This includes changing its icon and name to match the real extension.
A fake login popup appears to trick victims into entering their credentials, impersonating the real extension.
Now for the kicker.
From a victims perspective, everything now looks normal, and they might not even realize theyve been hacked.
Ill keep an eye out if and when a fix becomes available to update this story accordingly.
Ask yourself if you really need an extension first before installing anything.
