A cybersecurity incident has compromised at least 35 Google Chrome extensions, affecting approximately 2.6 million users globally. Over 400,000 devices have reportedly been infected with malicious code as part of a coordinated attack.

Timeline and Attack Methodology

An investigation revealed that the attack began on December 5, although related domains were registered as early as March 2024. This indicates the attackers had been preparing for months before launching their campaign.

One targeted entity was a data loss prevention startup, whose Chrome extension was exploited. The breach reportedly began with a phishing email impersonating a Google policy alert, urging a developer to install a "Privacy Policy Extension." This malicious extension, when granted permissions, allowed attackers to access the developer’s account.

Once access was obtained, the attackers uploaded a malicious update to the compromised extensions. This update bypassed security protocols and was automatically distributed to users, facilitating the infection. The primary objective appeared to be data harvesting, with an emphasis on collecting Facebook-related information from users.

Company Response and Security Observations

The affected company reported that the compromised employee had Google Advanced Protection and multi-factor authentication (MFA) enabled. Despite following standard protocols, the employee inadvertently authorized a malicious third-party application. The company clarified that no suspicious MFA prompts were received, and the employee's Google credentials remained secure.

Domains associated with the attack were initially registered in March 2024, with additional registrations occurring closer to the campaign’s escalation in November and December.

This incident underscores the evolving tactics of cybercriminals and the importance of constant vigilance and robust cybersecurity measures, particularly in the face of sophisticated phishing campaigns.