Cyberhaven’s preliminary analysis of the recent malicious Chrome extension

Source: Cyberhaven Author: unknown URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension

1. ONE SENTENCE SUMMARY: Cyberhaven’s Chrome extension was compromised through phishing, targeting Facebook Ads users, as part of a larger non-targeted attack.

2. MAIN POINTS:

3. Cyberhaven’s Chrome extension version 24.10.4 was maliciously published.

4. The attack was part of a wider campaign against Chrome extension developers.

5. A phishing email tricked an employee into authorizing a malicious OAuth application.

6. The attacker gained permissions and uploaded a malicious version of the extension.

7. The malicious code targeted Facebook users to collect sensitive data.

8. User data, including Facebook access tokens, was exfiltrated to a Command and Control server.

9. Malicious code tracked mouse clicks on Facebook to bypass security mechanisms.

10. The incident highlights vulnerabilities in the Chrome extension approval process.

11. Cyberhaven is cooperating with third-party security analyses to understand the incident.

12. Further updates will be released once the investigation is complete.

13. TAKEAWAYS:

14. Phishing remains a prevalent threat to corporate security.

15. OAuth applications require stricter scrutiny during authorization.

16. Regular audits of extensions could mitigate similar risks in the future.

17. Understanding attack methods helps in developing better defenses.

18. Collaboration with security experts is crucial in handling breaches.