Facebook filed a lawsuit yesterday against two companies that developed and distributed malicious Chrome extensions aimed at collecting and stealing user data from Facebook and Instagram. The companies sued are BrandTotal Ltd., an Israel-based company, and Unimania Inc., a Delaware-based company.
The two companies are behind “UpVoice” and “Ads Feed”, two Chrome extensions that have been available in the Chrome Web Store since September and November 2019, having so far accumulated more than 5,000 and 10,000 installations, respectively.
Regarding BrandTotal, Facebook said the company was incentivizing users to install the “UpVoice” extension from the Google Chrome Store by offering payments in exchange for installs, in the form of online gift cards, while claiming that users who installed the extension could influence the marketing decisions and strategies of multi-billion dollar brands. Similarly, Unimania Inc. was promoting its “Ads Feed” extension and claiming that users who installed the extension could influence the marketing decisions and strategies of multi-billion dollar brands.
However, as the tech giant states in its lawsuit, the two extensions were aimed at stealing public and private data from users' online accounts. Specifically, Facebook claims that both extensions stole data from user accounts on Facebook, Instagram, Amazon, Twitter and YouTube.
The stolen data typically included information from user profiles (name, user ID, gender, date of birth, relationship status, and location information), ads and related information (advertiser name, ad image and text, and user interaction and response metrics) , and user ad preferences (user ad interest information). The two companies were not authorized to access any of this information. Additionally, Facebook claims that the data illegally obtained through the two extensions has been repackaged and sold as “marketing intelligence” through the BrandTotal site.
Facebook also says that both extensions used nearly identical code to steal user data and sent the data to the same remote servers. This evidence leads Facebook to conclude that the two companies are in fact the same company, as they have, among other things, common employees and agents.
Thus, Facebook asked a judge to issue an injunction against the two companies, to prevent them from accessing the Facebook and Instagram sites and developing further extensions, while seeking compensation for the damages caused, bringing profits to the two companies.
It is noteworthy that, despite the widespread data theft detected by Facebook, even against Google-owned services, the two extensions are still available in the Chrome Web Store. Facebook said it has tried multiple times to remove them, but Google has not responded to its requests.
Unimania, before developing the “Ads Feed” extension, was involved in another scandal in 2018, when AdGuard found four of the company's Chrome extensions collecting Facebook user data.
As ZDNet reports, Facebook's legal department has been filing lawsuits against numerous companies that abuse its platform since early 2019. The following cases are noteworthy:
March 2019 : Facebook filed a lawsuit against two Ukrainian browser extension developers (Gleb Sluchevsky and Andrey Gorbachov) for stealing user data. August 2019 : Facebook sued LionMobi and JediMobi , two Android app developers, for “ad click fraud.” October 2019 : Facebook sued Israeli company NSO Group for developing and selling a WhatsApp zero-day that was used in May 2019 to attack lawyers, journalists, human rights activists, political dissidents, diplomats, and government officials. December 2019 : Facebook filed a lawsuit against ILikeAd and two Chinese nationals for using Facebook ads to trick unsuspecting users into downloading malware onto their devices. February 2020 : Facebook sued OneAudience , an SDK maker that secretly collected Facebook user data. March 2020 : Facebook sued Namecheap , one of the largest domain name registrars on the Internet, to “expose” hackers who created malicious domains through its service. April 2020 : Facebook sued LeadCloak for providing software aimed at covering up misleading ads related to the COVID-19 pandemic , pharmaceuticals, diet pills and more. June 2020 : Facebook sued MGP25 Cyberint Services , a company that operated a website that sold Instagram likes and comments . June 2020 : Facebook sued the owner of Massroot8.com , a site that stole Facebook user passwords. August 2020 : Facebook sued MobiBurn , the maker of an advertising SDK that was accused of stealing user data. August 2020 : Facebook sued the owner of Nakrutka , a site that sold Instagram likes , comments , and followers
