{"id":9294,"date":"2025-03-10T16:25:14","date_gmt":"2025-03-10T16:25:14","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/new-attack-clones-browser-extensions\/"},"modified":"2025-03-10T16:25:15","modified_gmt":"2025-03-10T16:25:15","slug":"new-attack-clones-browser-extensions","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/new-attack-clones-browser-extensions\/","title":{"rendered":"New Attack Clones Browser Extensions"},"content":{"rendered":"\n<\/p>\n
\n

\ue802<\/i>Mar 10, 2025<\/span>\ue804<\/i>Ravie Lakshmanan<\/span><\/span>Cybersecurity \/ Malware<\/span><\/p>\n<\/div>\n

\n
\n<\/p>\n

<\/a>\n<\/div>\n

Security experts have discovered a new method that enables a malicious browser extension to masquerade as a legitimate installed add-on, posing a significant threat to users’ online security.<\/p>\n

According to SquareX, “the polymorphic extensions can create an exact replica of the target’s icon, HTML popup, and workflows, and even temporarily disable the legitimate extension, making it highly convincing for victims to believe they are interacting with the real extension,” as stated in a recent report<\/a>.<\/p>\n

The stolen credentials can then be exploited by threat actors to take control of online accounts and gain unauthorized access to sensitive personal and financial information. This attack affects all Chromium-based web browsers, including Google Chrome, Microsoft Edge, Brave, Opera, and others.<\/p>\n

The approach relies on the fact that users often pin extensions to the browser’s toolbar. In a hypothetical attack scenario, threat actors could publish a polymorphic extension to the Chrome Web Store (or any extension marketplace) and disguise it as a utility, avoiding detection.<\/p>\n

\n

\n
\n\"Cybersecurity\"
\n<\/a>
\n<\/center>\n<\/div>\n

While the add-on provides the advertised functionality to avoid raising suspicions, it secretly activates malicious features by scanning for specific target extensions using a technique called web resource hitting, allowing it to identify potential targets.<\/p>\n

Once a suitable target extension is identified, the attack progresses to the next stage, transforming the rogue extension into a replica of the legitimate one. This is achieved by changing the icon to match the target’s and temporarily disabling the actual add-on via the “chrome.management” API, effectively removing it from the toolbar.<\/p>\n