Avast researchers said users who installed one of 28 third-party extensions containing hidden malicious JavaScript could be at risk of data theft and phishing attacks.
The extensions in question are primarily designed to help users download multimedia content from social networks including Facebook, Instagram, Vimeo, or Spotify. But Avast said users could end up being redirected to a site where the attacker gets paid for user visits. In other cases, users could end up on phishing sites.
“Anytime a user clicks on a link, the extensions send information about the click to the attacker’s control server, which can optionally send a command to redirect the victim from the real link target to a new hijacked URL before later redirecting them to the actual website they wanted to visit,” the security firm explained.
Names of extensions
Avast said it found evidence that some of the malicious extensions had been active since at least December 2018. The researchers discovered the code hidden in the apps last month and reported their findings to Google and Microsoft.
Both companies have said they are investigating the extensions. In the meantime, Avast has recommended that users disable or uninstall the extensions.
Here is the list of Chrome extensions that contain malicious code, according to Avast:
Direct Message for Instagram
DM for Instagram
Invisible mode for Instagram Direct Message
Downloader for Instagram
App Phone for Instagram
Stories for Instagram
Universal Video Downloader
Video Downloader for FaceBook™
Vimeo™ Video Downloader
Zoomer for Instagram and FaceBook
VK UnBlock. Works fast.
Odnoklassniki UnBlock. Works quickly.
Upload photo to Instagram™
Spotify Music Downloader
The New York Times News
Avast said the following Edge extensions contain malicious code:
Direct Message for Instagram™
Instagram Download Video & Image
App Phone for Instagram
Universal Video Downloader
Video Downloader for FaceBook™
Vimeo™ Video Downloader
Volume Controller
Stories for Instagram
Upload photo to Instagram™
Pretty Kitty, The Cat Pet
Video Downloader for YouTube
SoundCloud Music Downloader
Instagram App with Direct Message DM
Share your comments