This blog will focus on the functions which are responsible for sending the visited URLs to the server and processing the response.Ĭhrome extensions work by subscribing to events which they then use as triggers to perform a certain activity. The b0.js script contains many functions.
#Chrome extension set icon code
This HTML file loads b0.js and this is responsible for sending the URL being visited and injecting code into the eCommerce sites. The manifest.json sets the background page as bg.html. All 5 extensions perform similar behavior. This section contains the technical analysis of the malicious chrome extension ‘mmnbenehknklpbendgmgngeaignppnbe’. The users of the extensions are unaware of this functionality and the privacy risk of every site being visited being sent to the servers of the extension authors.įull Page Screenshot Capture – Screenshotting This action modifies the cookies on the site so that the extension authors receive affiliate payment for any items purchased.
They do this so that they can insert code into eCommerce websites being visited. Every website visited is sent to servers owned by the extension creator. T he la t ter borrows several phrases from another popular extension called GoFullPageĪpart from offering the intended functionality, the extensions also track the user’s browsing activity. The extensions offer various function s such as enabling users to watch Netflix shows together, website coupons, and taking screenshots of a website.
#Chrome extension set icon install
Since that time, we have investigated several other malicious extensions and discovered 5 extensions with a total install base of over 1,400,000 SeptemUpdate : Since the original publication of this blog on August 29, 2022, the AutoBuy browser extension was updated in the Chrome Store on Septemwith a version that no longer contains the potentially harmful features originally discussed in this blog.Ī few months ago, we blogged about malicious extensions redirecting users to phishing sites and inserting affiliate IDs into cookies of eCommerce sites. SeptemUpdate : Since the original publication of this blog on August 29, 2022, the Flipshope browser extension was updated in the Chrome Store on Septemwith a version that no longer contains the potentially harmful features originally discussed in this blog. Authored by Oliver Devane and Vallabh Chole
0 kommentar(er)
