Google removed 106 malicious Chrome extensions for secretly collecting sensitive data user.
The 106 extensions are part of a batch of 111 extensions identified as malicious, in a report published yesterday by security Awake Security.
According to Awake, the extensions are presented as tools that improve web searches, convert files to various formats, scan for viruses, and more.
In reality, however, the Chrome extensions contained code that allowed them to bypass Google's Chrome Web Store security scans, take screenshots, ' clipboards users, collect cookies , or monitor users' keystrokes.
Awake believes that all the extensions were created by the same hacker (or hacking group), but research is being conducted to confirm this information.
The common point in all Chrome extensions was sending data to domains registered through the GalComm domain registrar.
Additionally, many extensions share the same graphics and code base, with minor changes. In some cases, extensions even had the same version number and descriptions.
Awake says that by May 2020, when it also contacted Google, the 111 malicious extensions had been installed 32,962,951 times.
According to Awake, some of these Chrome extensions were detected on the networks of “financial services, oil and gas companies, media and entertainment companies, healthcare and pharmaceutical services, technology companies, higher education institutions, and government agencies.” The extensions were said to have acted as backdoors and tools spying, although there is no evidence to prove this.
Only 5 of the 111 extensions that Awake reported to Google are still live in the Chrome Web Store.
As always happens in such cases, Google disabled the extensions from users' browsers. The extensions are still installed, but they have been disabled and marked as "malware" in the extensions section of the Chrome browser.
Users can visit the chrome://extensions page to see if they have any of the malicious extensions installed.
