{"id":143536,"date":"2022-03-10T11:26:26","date_gmt":"2022-03-10T19:26:26","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=143536"},"modified":"2024-02-26T23:09:55","modified_gmt":"2024-02-27T07:09:55","slug":"imposter-netflix-chrome-extension-dupes-100k-users","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/","title":{"rendered":"Imposter Netflix Chrome Extension Dupes 100k Users"},"content":{"rendered":"

Authored by Oliver Devane, Vallabh Chole, and Aayush Tyagi<\/span>\u00a0<\/span><\/p>\n

McAfee has recently observed several malicious Chrome Extensions which, once installed, will redirect users to phishing sites, insert Affiliate IDs and modify legitimate websites to exfiltrate personally identifiable information (PII) data. According to the Google Extension Chrome Store, the combined install base is 100,000<\/span>\u00a0<\/span><\/p>\n

McAfee Labs has observed th<\/span>e<\/span>s<\/span>e<\/span> extension<\/span>s<\/span> are prevalent in USA, Europe and India as we can observe in the h<\/span>ea<\/span>tmap<\/span> below<\/span>.<\/span>\u00a0<\/span><\/p>\n

\"\"<\/p>\n

The perpetrator targets over 1,400 domains, where 100 of them belong to the top 10,000 Alexa<\/a> ranking including hbomax.com, hotels.com and expedia.com.<\/p>\n

One extension, \u2018Netflix Party\u2019, mimics the original Netflix Party extension, which allows groups of people to watch Netflix shows at the same time. However, this version monitors all the websites you visit and performs several malicious activities.\u00a0<\/span>\u00a0<\/span><\/p>\n

\"\"<\/p>\n

The malicious <\/span>actor <\/span>behind the extension<\/span>s<\/span> ha<\/span>s<\/span> created several Twitter accounts and fake review websites to deceive users <\/span>into<\/span> trusting and <\/span>install<\/span>ing<\/span> the<\/span> extensions<\/span>.<\/span><\/span>\u00a0<\/span><\/p>\n

\"\"<\/p>\n

T<\/span>he<\/span> victim will be tricked into installing the extension and their data will be stolen <\/span>when <\/span>browsing a <\/span>gift card<\/span> site<\/span>.<\/span>\u00a0<\/span><\/span>\u00a0<\/span><\/p>\n

\"\"<\/p>\n

The details of each step are as follows:<\/span>\u00a0<\/span><\/p>\n

    \n
  1. The perpetrator creates malicious extensions and adds them to the Chrome Extension Store. They create fake websites to review the extensions and fake Twitter accounts to publicize them.\u00a0<\/span>\u00a0<\/span><\/li>\n
  2. A victim may perform a web or Twitter search for Netflix Party, read the review and click on a link that will lead them to the Google Chrome Store.\u00a0<\/span>\u00a0<\/span><\/li>\n
  3. They click to install the Extension and accept the permissions.<\/span>\u00a0<\/span><\/li>\n
  4. The victim will either perform a web search or directly navigate to the gift card website. The Extension will identify the website and redirect them to the phishing page.<\/span>\u00a0<\/span><\/li>\n
  5. The victim will enter their gift card information on the phishing page.<\/span>\u00a0<\/span><\/li>\n
  6. The gift card information is posted to the server to which the malicious actor has access. They can now use or sell the stolen data and the victim will lose their funds.<\/span>\u00a0<\/span><\/li>\n<\/ol>\n

    Technical Analysis<\/span>\u00a0<\/span><\/h2>\n

    This section contains the technical analysis of the malicious chrome extension “<\/span>bncibciebfeopcomdaknelhcohiidaoe<\/span><\/i><\/b>“.<\/i>\u00a0<\/span><\/p>\n

    Manifest.json<\/span>\u00a0<\/span><\/h2>\n

    The manifest.json file contains the permissions of the extension. The \u2018unsafe-eval\u2019 permission in the \u2018content_security_policy\u2019 and the allowed use of content.js on any website visited by the user is of particular concern<\/span>\u00a0<\/span><\/p>\n

    \"\"<\/p>\n

    Background.js<\/span>\u00a0<\/span><\/h2>\n

    When the extension is installed, the background.js script will be loaded. This file uses a simple obfuscation technique of putting all the code on one line which makes it difficult to read. This is easily cleaned up by using a code beautifier and the image below shows the obfuscated script on the first line and the cleaned-up code below the red arrow.\u00a0<\/span>\u00a0<\/span><\/p>\n

    \"\"<\/p>\n

    This script <\/span>accesses<\/span> https:\/\/accessdashboard[.]live<\/span> to download a script and store it <\/span>as variable \u2018code\u2019 in Chrome<\/span>\u2019<\/span>s local storage. <\/span>This <\/span>stored variable<\/span> is then reference<\/span>d<\/span> in the content.js script<\/span>,<\/span> which is executed on every visited website.\u00a0<\/span><\/span>\u00a0<\/span><\/p>\n

    \"\"<\/p>\n

    Content.js<\/span>\u00a0<\/span><\/h2>\n

    After beautification, we see the code will read the malicious script from the \u2018code\u2019 variable which was previously stored.<\/span>\u00a0<\/span><\/p>\n

    \"\"<\/p>\n

    \u2018Code\u2019\u00a0<\/span>\u00a0<\/span><\/h2>\n

    The malicious code has three main functions, redirection for phishing, modifying of cookies to add AffiliateIDs, and modifying of website code to add chat windows.\u00a0<\/span>\u00a0<\/span><\/p>\n

    \"\"<\/p>\n

    Redirection for Phishing<\/span><\/i>\u00a0<\/span><\/h2>\n

    Redirection for phishing works by checking if the URL being accessed matches a list, and conditionally redirects to a malicious IP that hosts the phishing site.\u00a0<\/span>\u00a0<\/span><\/p>\n

    URLs monitored are:<\/span>\u00a0<\/span><\/p>\n

      \n
    • https[:]\/\/<\/span>www.target.com\/guest\/gift-card-balance<\/span>\u00a0<\/span><\/li>\n
    • https[:]\/\/www.macys.com\/account\/giftcardbalance<\/span>\u00a0<\/span><\/li>\n
    • https[:]\/\/www.nike.com\/orders\/gift-card-lookup<\/span>\u00a0<\/span><\/li>\n
    • https[:]\/\/www.nordstrom.com\/nordstrom-gift-cards<\/span>\u00a0<\/span><\/li>\n
    • https[:]\/\/www.sephora.com\/beauty\/giftcards<\/span>\u00a0<\/span><\/li>\n
    • https[:]\/\/www.sephoragiftcardbalance.com<\/span>\u00a0<\/span><\/li>\n
    • https[:]\/\/balance.amexgiftcard.com<\/span>\u00a0<\/span><\/li>\n
    • https[:]\/\/prepaidbalance.americanexpress.com\/GPTHBIWeb\/validateIPAction.do?clientkey=retail%20sales%20channel<\/span>\u00a0<\/span><\/li>\n
    • https[:]\/\/amexprepaidcard.com<\/span>\u00a0<\/span><\/li>\n
    • [:]\/\/secure4.store.apple.com\/shop\/giftcard\/balance<\/span>\u00a0<\/span><\/li>\n<\/ul>\n

      Upon navigating to one of the above sites, the user will be redirected to 164[.]90[.]144[.]88. An observant user would notice that the URL would have changed to an IP address, but some users may not.<\/span>\u00a0<\/span><\/p>\n

      The image below shows the Apple Phishing site and the various phishing kits being hosted on this server.<\/span>\u00a0<\/span><\/p>\n

      \"\"<\/p>\n

      The phishing sites share similar co<\/span>de<\/span>s<\/span>. If a user enters their <\/span>gift <\/span>card<\/span> information, the data will be posted to <\/span>5<\/span>2.8.106.52<\/span>. <\/span>A network capture of the post request is shown below:<\/span><\/span>\u00a0<\/span><\/p>\n

      \"\"<\/p>\n

      Modifying of cookies to add AffiliateIDs<\/span><\/i>\u00a0<\/span><\/h2>\n

      The second malicious function contains AIPStore which is a dictionary containing a list of URLs and their respective monetizing sites which provide affiliate IDs. This function works by loading new tabs which will result in cookies being set on the visited sites. The flow below describes how the extension will work.<\/span>\u00a0<\/span><\/p>\n

      \"\"<\/p>\n

        \n
      1. A user navigates to a retail website<\/span>\u00a0<\/span><\/li>\n
      2. If the retail website is contained in the AIPStore keymap, the extension will load a new tab with a link to a monetizing site which sets the cookie with the affiliate ID. The new tab is then closed, and the cookie will persist.\u00a0<\/span>\u00a0<\/span><\/li>\n
      3. The user will be unaware that a cookie would have been set and they will continue to browse the website.<\/span>\u00a0<\/span><\/li>\n
      4. Upon purchasing any goods, the Affiliate ID will be recognized by the site vendor and commission will be sent to the Affiliate ID owner which would be the Malicious Actor<\/span>\u00a0<\/span><\/li>\n<\/ol>\n

        The left image below shows the original site with no affiliate cookie, the one on the right highlights the cookie that has been added by the extension.<\/span>\u00a0<\/span><\/p>\n

        \"\"<\/p>\n

        Chat Windows<\/span><\/i>\u00a0<\/span><\/h2>\n

        The final function checks a list of URLs being accessed and if they match, a JS script will be injected into the HTML code which will result in a chat window being displayed. The image below shows the injected script and the chat window.<\/span>\u00a0<\/span><\/p>\n

        \"\"<\/p>\n

        The chat window may be used by the malicious actor to request PII data, credit card, and product key information.<\/span>\u00a0<\/span><\/p>\n

        Conclusion<\/span>\u00a0<\/span><\/h2>\n

        This threat is a good example of the lengths malicious actors will go to trick users into installing malware such as creating Twitter accounts and fake review websites.\u00a0<\/span>\u00a0<\/span><\/p>\n

        McAfee advises its customers to be cautious when installing Chrome Extensions and pay attention to the permissions that they are requesting.\u00a0<\/span>\u00a0<\/span><\/p>\n

        The permissions will be shown by Chrome before the installation of the Extension. Customers should take extra steps to verify the authenticity if the extension is requesting permissions that enable it to run on every website you visit such as the one detailed in this blog<\/span>\u00a0<\/span><\/p>\n

        \"\"<\/p>\n

        McAfee customers are protected against the<\/span> malicious sites detailed in this blog <\/span>as they are blocked with McAfee WebAdvisor<\/span> as shown below.<\/span>\u00a0<\/span><\/span>\u00a0<\/span><\/p>\n

        \"\"<\/p>\n

        The Malicious code within the extension is detected as Phish-Extension. Please perform a \u2018Full\u2019 scan via the product.<\/span>\u00a0<\/span><\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
        Type<\/span>\u00a0<\/span><\/td>\nValue<\/span>\u00a0<\/span><\/td>\nProduct<\/span>\u00a0<\/span><\/td>\nDetected<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
        URL \u2013 Phishing Sites<\/span>\u00a0<\/span><\/td>\n164.90.141.88\/*<\/span>\u00a0<\/span><\/td>\nMcAfee WebAdvisor<\/span>\u00a0<\/span><\/td>\nBlocked<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
        Chrome Extension<\/span>\u00a0<\/span><\/td>\nnetflix-party – bncibciebfeopcomdaknelhcohiidaoe<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nPhish-Extension<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
        Chrome Extension<\/span>\u00a0<\/span><\/td>\nteleparty – flddpiffdlibegmclipfcnmaibecaobi<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nPhish-Extension<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
        Chrome Extension<\/span>\u00a0<\/span><\/td>\nhbo-max-watch-party – dkdjiiihnadmgmmfobidmmegidmmjobi<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nPhish-Extension<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
        Chrome Extension<\/span>\u00a0<\/span><\/td>\nprime-watch-party – hhllgokdpekfchhhiknedpppjhgicfgg<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nPhish-Extension<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
        Chrome Extension<\/span>\u00a0<\/span><\/td>\nprivate-watch-party – maolinhbkonpckjldhnocgilkabpfodc<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nPhish-Extension<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
        Chrome Extension<\/span>\u00a0<\/span><\/td>\nhotstar-ad-blocker – hacogolfhplehfdeknkjnlblnghglfbp<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nPhish-Extension<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
        Chrome Extension<\/span>\u00a0<\/span><\/td>\nhbo-ad-blocker – cbchmocclikhalhkckeiofpboloaakim<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nPhish-Extension<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
        Chrome Extension<\/span>\u00a0<\/span><\/td>\nblocksite – pfhjfcifolioiddfgicgkapbkfndaodc<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nPhish-Extension<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
        Chrome Extension<\/span>\u00a0<\/span><\/td>\nhbo-enhanced – pkdpclgpnnfhpapcnffgjbplfbmoejbj<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nPhish-Extension<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
        Chrome Extension<\/span>\u00a0<\/span><\/td>\nhulu-watch-party – hkanhigmilpgifamljmnfppnllckkpda<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nPhish-Extension<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
        Chrome Extension<\/span>\u00a0<\/span><\/td>\ndisney-plus-watch-party – flapondhpgmggemifmemcmicjodpmkjb<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nPhish-Extension<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
        Chrome Extension<\/span>\u00a0<\/span><\/td>\nspotify-ad-blocker – jgofflaejgklikbnoefbfmhfohlnockd<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nPhish-Extension<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
        Chrome Extension<\/span>\u00a0<\/span><\/td>\nott-party – lldibibpehfomjljogedjhaldedlmfck<\/span>\u00a0<\/span><\/td>\nTotal Protection and LiveSafe<\/span>\u00a0<\/span><\/td>\nPhish-Extension<\/span>\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        \u00a0<\/span><\/p>\n

         <\/p>\n","protected":false},"excerpt":{"rendered":"

        Authored by Oliver Devane, Vallabh Chole, and Aayush Tyagi\u00a0 McAfee has recently observed several malicious Chrome Extensions which, once installed,…<\/p>\n","protected":false},"author":695,"featured_media":144211,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[14521,5941],"coauthors":[4136],"class_list":["post-143536","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-mcafee-labs","tag-scam","tag-scams"],"acf":[],"yoast_head":"\nImposter Netflix Chrome Extension Dupes 100k Users | McAfee Blog<\/title>\n<meta name=\"description\" content=\"Authored by Oliver Devane, Vallabh Chole, and Aayush Tyagi\u00a0 McAfee has recently observed several malicious Chrome Extensions which, once installed, will\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Imposter Netflix Chrome Extension Dupes 100k Users | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"Authored by Oliver Devane, Vallabh Chole, and Aayush Tyagi\u00a0 McAfee has recently observed several malicious Chrome Extensions which, once installed, will\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2022-03-10T19:26:26+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-02-27T07:09:55+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/03\/300x200_Blog_scamparty.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"300\" \/>\n\t<meta property=\"og:image:height\" content=\"200\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"McAfee Labs\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee_Labs\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee Labs\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/\"},\"author\":{\"name\":\"McAfee Labs\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\"},\"headline\":\"Imposter Netflix Chrome Extension Dupes 100k Users\",\"datePublished\":\"2022-03-10T19:26:26+00:00\",\"dateModified\":\"2024-02-27T07:09:55+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/\"},\"wordCount\":1247,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/03\/300x200_Blog_scamparty.jpg\",\"keywords\":[\"scam\",\"scams\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/\",\"name\":\"Imposter Netflix Chrome Extension Dupes 100k Users | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/03\/300x200_Blog_scamparty.jpg\",\"datePublished\":\"2022-03-10T19:26:26+00:00\",\"dateModified\":\"2024-02-27T07:09:55+00:00\",\"description\":\"Authored by Oliver Devane, Vallabh Chole, and Aayush Tyagi\u00a0 McAfee has recently observed several malicious Chrome Extensions which, once installed, will\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/#primaryimage\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/03\/300x200_Blog_scamparty.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/03\/300x200_Blog_scamparty.jpg\",\"width\":300,\"height\":200},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Imposter Netflix Chrome Extension Dupes 100k Users\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\",\"name\":\"McAfee Labs\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"caption\":\"McAfee Labs\"},\"description\":\"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee_Labs\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Imposter Netflix Chrome Extension Dupes 100k Users | McAfee Blog","description":"Authored by Oliver Devane, Vallabh Chole, and Aayush Tyagi\u00a0 McAfee has recently observed several malicious Chrome Extensions which, once installed, will","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Imposter Netflix Chrome Extension Dupes 100k Users | McAfee Blog","og_description":"Authored by Oliver Devane, Vallabh Chole, and Aayush Tyagi\u00a0 McAfee has recently observed several malicious Chrome Extensions which, once installed, will","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2022-03-10T19:26:26+00:00","article_modified_time":"2024-02-27T07:09:55+00:00","og_image":[{"width":300,"height":200,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/03\/300x200_Blog_scamparty.jpg","type":"image\/jpeg"}],"author":"McAfee Labs","twitter_card":"summary_large_image","twitter_creator":"@McAfee_Labs","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee Labs","Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/"},"author":{"name":"McAfee Labs","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad"},"headline":"Imposter Netflix Chrome Extension Dupes 100k Users","datePublished":"2022-03-10T19:26:26+00:00","dateModified":"2024-02-27T07:09:55+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/"},"wordCount":1247,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/03\/300x200_Blog_scamparty.jpg","keywords":["scam","scams"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/","name":"Imposter Netflix Chrome Extension Dupes 100k Users | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/03\/300x200_Blog_scamparty.jpg","datePublished":"2022-03-10T19:26:26+00:00","dateModified":"2024-02-27T07:09:55+00:00","description":"Authored by Oliver Devane, Vallabh Chole, and Aayush Tyagi\u00a0 McAfee has recently observed several malicious Chrome Extensions which, once installed, will","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/#primaryimage","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/03\/300x200_Blog_scamparty.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/03\/300x200_Blog_scamparty.jpg","width":300,"height":200},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/imposter-netflix-chrome-extension-dupes-100k-users\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Imposter Netflix Chrome Extension Dupes 100k Users"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad","name":"McAfee Labs","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","caption":"McAfee Labs"},"description":"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.","sameAs":["https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee_Labs"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/143536","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/695"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=143536"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/143536\/revisions"}],"predecessor-version":[{"id":184269,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/143536\/revisions\/184269"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media\/144211"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=143536"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=143536"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=143536"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=143536"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}