Third Party Browser Extensions for Instagram, Facebook, Vimeo and Others Infected with Malware
fliptop writes:
In a press release, security firm Avast has said around 3 million people are affected worldwide:
Threat Intelligence researchers from Avast (LSE:AVST), a global leader in digital security and privacy products, have identified malware hidden in at least 28 third party Google Chrome and Microsoft Edge extensions associated with some of the world's most popular platforms. The malware has the functionality to redirect user's traffic to ads or phishing sites and to steal people's personal data, such as birth dates, email addresses, and active devices. According to the app stores' download numbers, around three million people may be affected worldwide.
The extensions which aid users in downloading videos from these platforms include Video Downloader for Facebook, Vimeo Video Downloader, Instagram Story Downloader, VK Unblock, and other browser extensions on the Google Chrome Browser, and some on Microsoft Edge Browser. The researchers have identified malicious code in the Javascript-based extensions that allows the extensions to download further malware onto a user's PC.
[...] The Avast Threat Intelligence team started monitoring this threat in November 2020, but believe that it could have been active for years without anyone noticing. There are reviews on the Chrome Web Store mentioning link hijacking from as far back as December 2018. Rubin added, "The extensions' backdoors are well-hidden and the extensions only start to exhibit malicious behavior days after installation, which made it hard for any security software to discover."
[...] At this moment, the infected extensions are still available for download. Avast has contacted the Microsoft and Google Chrome teams to report them. Both Microsoft and Google confirmed they are currently looking into the issue. In the meantime, Avast recommends users disable or uninstall the extensions for now until the problem is resolved and then scan for and remove the malware.
Read more of this story at SoylentNews.