Researchers have identified malware hidden in at least 28 third party Google Chrome and Microsoft Edge extensions with over 3 million installs and associated with Instagram, Facebook, Vimeo and other popular platforms. The malware redirects user’s traffic to ads or phishing sites to steal consumers personal data, such as birth dates, email addresses, and active devices.
There are hundreds of thousands of browser extensions. Some are malicious and bring malware with them, which can pose serious threats to both privacy and security.
When visiting a site, a consumer expects a smooth and trusted experience, but malicious ads and malware can result in the exact opposite. Consumers could knowingly or unknowingly download these extensions. Browsers are like the new super cookie, with users often downloading malware unknowingly. The average consumer typically doesn’t understand what they are getting when they add an extension to their browser. They believe malicious ads and malware come from the site owner – a belief that can really damage the site’s brand reputation.
The malware downloaded on the shopper’s browser can follow them as they browse the internet. When visiting other sites in the future, the malware shows up, further interrupting their experience. Since much of this behavior happens on the client side, website owners have no visibility into any of it.
Online shoppers should conduct an audit of their current Chrome browser extensions and uninstall any suspicious ones. It’s important to stay cautious and look for warning signs when downloading extensions in the future. These warning signs include checking popularity of the extensions, including number of users and reviews. Extensions with only a few hundred users, and few or no reviews, should be considered suspicious. Users should also pay close attention to the permissions an extension requests. If it requires any privileged access, such as to read or change data, or access to a broad set of sites one visits, it might be best to pass. Consumers should also keep their browsers updated and use anti-virus and endpoint security solutions. Website owners should look for solutions that can actively detect, manage and block malicious browser extensions on the client side.