Google removed from Chrome Web Store 32 harmful extensions, totaling 75 million downloads. Expansion could change the search results, as well as send spam or undesirable advertising.
Users’ vigilance was euthanized by the fact that the extensions really performed the function promised by the authors. And in general, harmful activity was not obvious, so it was quite difficult to notice it.
Cybersecurity researcher Vladimir Palant analyzed one of these extensions under The name “PDF Toolbox” with 2 million downloads available in Chrome Web Store, and found that it contained an outstanded malicious code, which remained unnoticed at least a year.
“This code allows the web site” serasearchtop.com “to introduce an arbitrary JavaScript code on all websites you visit. Although I can’t say what this is used, the most likely use is the introduction of advertising. But more are possible Gnousse applications, ”said Palant.
A few days ago, the researcher published Another message on this occasion. Palant warned that he discovered the same suspicious code in other 18 Chrome extensions with a total number of loads of 55 million. Some examples include:
- “Autoskip for YouTube” – 9 million active users;
- “Soundbook” – 6.9 million active users;
- “Crystal Ad Block” – 6.8 million active users;
- “Brisk VPN” – 5.6 million active users;
- “Clipboard Helper” – 3.5 million active users;
- “Maxi refresher” – 3.5 million active users.
The most popular remote extension
Although the researcher did not observe any obvious harmful activity of extensions, he noted that the store has numerous users’ reports indicating that the extensions performed redirecting and intercepted the search results. Attempts to report the find in Google were unsuccessful, so the “heavy artillery” came to the rescue.