The Chrome extension stole personal data and has been downloaded more than 30 million times

Original title: "Chrome Malware Extensions Steal Personal Data, Downloaded more than 30 million times"

Source: OSChina

Google's Chrome Web Store has been hit by the biggest surveillance campaign to date. By May 2020, the campaign had successfully stolen data from users around the world by downloading more than 32 million malicious extensions.

The Awake Security Threat research team has released a research report that reveals a large-scale global monitoring campaign that takes advantage of the nature of Internet domain registrations and browser capabilities to monitor and steal data from users from multiple regions and industry segments. Studies have shown that this criminal activity was perpetrated by a single Internet domain registrar: CommuniGal Communication Ltd. (GalComm)& NBSP; To promote.

It says that by taking advantage of its trust as a registrar of domain names, GalComm has enabled malicious activity that has been detected in more than 100 networks examined. Moreover, even in complex organizations that have invested heavily in network security, malicious activity can be hidden by bypassing multiple layers of security controls.

Awake notes in his report that there are 26,079 accessible domains registered with GalComm, of which more than 15,000 are malicious or suspicious.

In the past three months alone, it has collected 111 malicious or bogus Chrome extensions using the GalComm domain for attackers' command and control infrastructure and/or as add-on pages for extensions. These extensions can capture screen captures, read the clipboard, get credential tokens stored in cookies or parameters, and get the user's keystrokes, such as passwords.

Examples of tempting to install malicious Chrome extensions

By May 2020, the 111 malicious extension downloads have reached NBSP; 32962951 & have spent Times. Awake  The company has worked with Google to begin removing the extensions from the Chrome Web store, the company said.

In this case Moshe Fogel , GalComm's head; In communication with Reuters notes that "Gal С omm not participate in any malicious activity, can say on the contrary, we cooperate with law enforcement and security agencies, do everything we can to prevent". In & have spent Moshe Fogel  after Awake Security publishes its report and lists all the suspect domain names; It also said that the use of these domain names is almost inactive, and will continue to investigate other domain names.

More detailed information about the report to view: https://awakesecurity.com/blog/the-internets-new-arms-dealers-malicious-domain-registrars/

The original address: https://www.oschina.net/news/116689/google-chrome-extension-32m-downloads

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia