{"id":36466,"date":"2020-08-05T15:18:48","date_gmt":"2020-08-05T15:18:48","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/31461\/295-Chrome-Extensions-Caught-Hijacking-Searches.html"},"modified":"2020-08-05T15:18:48","modified_gmt":"2020-08-05T15:18:48","slug":"295-chrome-extensions-caught-hijacking-searches","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/295-chrome-extensions-caught-hijacking-searches\/","title":{"rendered":"295 Chrome Extensions Caught Hijacking Searches"},"content":{"rendered":"
\"Chrome<\/span>
<\/span><\/figcaption><\/figure>\n

More than 80 million Chrome users have installed one of 295 Chrome extensions that hijack and insert ads inside Google and Bing search results.<\/p>\n

The malicious extensions were discovered by AdGuard, a company that provides ad-blocking solutions, while the company’s staff was looking into a series of fake ad-blocking extensions that were available on the official Chrome Web Store.<\/p>\n

A subsequent investigation into the fake ad blockers unearthed a larger group of malicious activity spreading across 295 extensions.<\/p>\n

Besides fake ad blockers, AdGuard said it also found extensions posing as weather forecast widgets and screenshot capture utilities.<\/p>\n

However, the vast majority of the malicious extensions (245 out of the 295 extensions) were simplistic utilities that had no other function than to apply a custom background for Chrome’s “new tab” page.<\/p>\n

In a technical analysis shared with ZDNet, AdGuard said all extensions loaded malicious code from the fly-analytics.com domain, and then proceeded to quietly inject ads inside Google and Bing search results.<\/p>\n

Almost all the 295 extensions were still available on the official Chrome Web Store earlier today, when we received the list from AdGuard.<\/p>\n

\n
\n
\n

I honestly tried reporting this to Google using different channels, but weeks passed and they all are still on Chrome Web Store.<\/p>\n

OK, Google, what one should do to help you remove malware from @googlechrome<\/a> Web Store? https:\/\/t.co\/mjE0a100ft<\/a><\/p>\n

\u2014 Andrey Meshkov (@ay_meshkov) August 4, 2020<\/a><\/p><\/blockquote><\/div>\n<\/figure>\n

<\/section>\n

Extensions started being pulled down from the store after we reached out to Google’s Web Store team and after AdGuard published a blog post detailing their findings.<\/p>\n

The same blog post<\/a> also details additional bad practices on the Chrome Web Store, such as store moderators allowing a large number of copycat extensions to clone popular add-ons, capitalize on their brands, reach millions of users, while also containing malicious code that performs ad fraud or cookie stuffing<\/a>.<\/p>\n

The full list of 295 ad-injecting extensions is available below, at the end of this article.<\/p>\n

When Google removes an extension from the Chrome Web Store for malicious activity, the extension is also disabled in users’ browsers and marked as “malware” in Chrome’s Extension section.<\/p>\n

Users still have to manually uninstall it from their browsers.<\/p>\n

\n

Format: [extension ID<\/em>] [extension name<\/em>]<\/strong><\/p>\n