Chrome extensions are special small add-ons that are installed separately in the browser and increase its functionality. The tasks that this customizable function can perform are very diverse: blocking ads, adjusting the appearance, improving notifications, working with various services and much more. Some extensions are so powerful that they can track your sensitive information and leak it to third parties.

Malicious extensions

It all started with the discovery of malicious code in a browser extension called “PDF Toolbox”. Officially, this program allows you to work with PDF files, convert, merge, download, etc. However, it can also inject malicious JavaScript code into any site you visit. Provides functionality capture everything you do and write in the browser, including passwords, card details, personal messages.

One of the actions the malicious code also performed was to redirect user searches from Google to third-party search engines. This was probably done for a small affiliate fee. Developers can make huge profits by infecting 57 million browsers.

After that, 17 more extensions with similar code were found to load and run the JavaScript file. To contain:

• Auto skip for YouTube.
• Crystal Ad Block.
• Live VPN.
• Clipboard Assistant.
• Maxi Refresher.
• Fast Translation.
• Easyview Reader view.
• Zoom Plus.
• Basic Image Downloader.
• Click fun cursors.
• Maximum Color Changer for Youtube.
• Readl Reader mode.
• Image download center.
• Font Customizer.
• Easy Undo Closed Tabs.
• OneCleaner.
• Repeat button.

There are likely to be other infected extensions. These are only those found in a sample of about 1000 samples.