{"id":76816,"date":"2017-08-09T14:25:14","date_gmt":"2017-08-09T21:25:14","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=76816"},"modified":"2025-08-14T02:10:16","modified_gmt":"2025-08-14T09:10:16","slug":"phishing-attacks-target-google-chrome-extensions-spread-adware","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/privacy-identity-protection\/phishing-attacks-target-google-chrome-extensions-spread-adware\/","title":{"rendered":"Recent Phishing Attacks Target Google Chrome Extensions, Spread Adware to 1 Million Users"},"content":{"rendered":"

Browser extensions help us out with our grammar, they allow us to video chat online, they even permit us to play games. Their intent is to extend the functionality of a web\u00a0browser. Unfortunately, they\u2019re also being leveraged by cybercriminals to extend the functionality of their own malicious campaigns<\/a>. In fact, this past week we\u2019ve seen a wave of\u00a0phishing attacks<\/a>\u00a0aimed at the developers of popular browser extensions for Google Chrome. Cybercriminals are conducting these attacks in order to hijack these extensions and use them to spread adware<\/a> to innocent users.<\/p>\n

So, what do these attacks look like exactly? One campaign saw cybercriminals\u00a0compromising<\/a>\u00a0the Chrome Web Store account of a German developer team in order to\u00a0hijack the \u201cCopyfish\u201d extension, which is a browser extension that performs optical character recognition. After gaining control of the extension, the crooks then modified \u201cCopyfish\u201d with ad-injection capabilities to distribute spam correspondence to users.<\/p>\n

The second attack we\u2019ve seen features the popular Chrome extension \u201cWeb Developer,\u201d which adds a toolbar button to a browser that includes various web developer tools. Once they got inside the creator\u2019s account, cybercriminals used the popular plug-in to their advantage, directly injecting adware into the web browser of its 1 million users.<\/p>\n

Tips to Stay Secure From Attacks<\/h2>\n

Though adware is largely just an annoyance for innocent users, the larger issue with this attack is that cybercriminals can now potentially access users\u2019 web account info. Since these plugins have access to pretty much everything that’s happening on a user’s browser and can do anything from reading all website content to intercepting traffic, it\u2019s important users start thinking about protection. Therefore, to stay secure from these types of attacks, follow these tips:<\/p>\n