Malicious Chrome Extensions Capture Web Browser Activity

Security researchers have detected a new group of malicious Chrome extensions capable of capturing sensitive information entered in web browsers such as names, credit card numbers, CVV numbers, and email addresses. These extensions abuse session replay, a JavaScript code commonly used by website administrators to analyze how users interact with their site. The malicious extensions have random names, such as Strawberry Daiquiri Cocktail and BrowserWatch, and inject advertisements into the webpages a user is viewing. The malicious extensions are estimated to have impacted over 400,000 users prior to their removal from the Chrome Web Store. 

The NJCCIC recommends users review Trend Micro’s report for a list of the malicious extensions. We also recommend users review Bleeping Computer’s article for removal instructions and consider installing a reputable ad-blocking and/or script-blocking extension.