Google and Microsoft Trusted Them. 2.3 Million Users Installed Them. They Were Malware!
TL;DR - An investigation of a single “verified” color picker exposed a coordinated campaign of 18 malicious extensions that infected a massive 2.3 million users across Chrome and Edge...
If you think a Chrome extension with #Google’s verified badge, 100,000+ installs, 800+ reviews, and featured placement on the store is trustworthy? Think again... Meet “Color Picker, Eyedropper — Geco colorpick”, an extension that perfectly demonstrates how sophisticated threat actors are exploiting the trust signals we rely on. This isn’t some obvious scam extension thrown together in a weekend. This is a carefully crafted trojan horse that delivers exactly what it promises (a functional color picker) while simultaneously hijacking your browser, tracking every website you visit, and maintaining a persistent command and control backdoor. Not only that, but it remained legitimate for years before becoming malicious through a version update.
If that is not enough, meet the RedDirection campaign. Our investigation into the Color Picker extension revealed it was just the tip of the iceberg. By analyzing the command and control infrastructure and tracking similar code patterns, we uncovered what we’re calling the RedDirection campaign, a sophisticated cross-platform network of eighteen malicious extensions spanning both #Chrome and #Edge stores, all sharing the same hijacking functionality. Combined, these eighteen extensions have infected over 2.3 million users across both browsers, creating one of the largest browser hijacking operations we’ve documented.
These extensions masquerade as popular productivity and entertainment tools across diverse categories: emoji keyboards, weather forecasts, video speed controllers, #VPN proxies for #Discord and #TikTok, dark themes, volume boosters, and #YouTube unblockers. Each provides legitimate functionality while secretly implementing the same browser surveillance and hijacking capabilities we discovered in the color picker.
Several of these extensions have achieved verified status or featured placement across both the Chrome Web Store and Microsoft Edge Add-ons store, demonstrating that security failures extend across both major browser marketplaces. Each extension operates with its own command and control subdomain (like admitclick.net, click.videocontrolls.com, c.undiscord.com), giving the appearance of separate operators while actually being part of the same centralized attack infrastructure spanning both platforms.
▶️ Read On
https://t.me/InformationTechnologySecurity
