In this episode of CyberInsider, we analyze a critical security alert involving thirty-one malicious Chrome VPN extensions. Researchers at RiskyPlugins recently discovered that these extensions, which collectively amassed over 356,000 users, contain hidden code allowing operators to intercept and reroute browsing traffic via proxy servers. Predominantly targeting Russian-speaking users, these extensions disguised themselves as tools for accessing restricted services like ChatGPT, YouTube, and Telegram.
The investigation reveals that these extensions utilize intrusive permissions, including host access to all URLs and proxy auto-configuration scripts. This configuration enables malicious actors to modify traffic destinations post-installation, posing a significant threat to user privacy and data security. By monitoring these extensions, experts identified a cluster linked to three publisher accounts that remained active on the Chrome Web Store despite the identified vulnerabilities.
This discovery highlights ongoing concerns regarding the vetting of browser extensions and the dangers of proxy-based malware. The incident serves as a stark reminder of the risks associated with third-party software and the importance of scrutinizing permissions before installation. For cybersecurity professionals, this case underscores the necessity of improved detection mechanisms for malicious extensions within major browser marketplaces.
---
📰 Read the full article here
🌐 Visit https://cyberinsider.com
