Malicious Browser Extensions Are Stealing Sensitive Authentication Data

Malicious Browser Extensions Are Stealing Sensitive Authentication Data A recent malicious campaign called operation phantom enigma uses a mix of malicious browser extensions to bypass traditional security measures and phishing tactics to steal sensitive data from major financial institutions. These extensions looked like harmless proxy tools, but behind the scenes, they were hijacking traffic and stealing sensitive data from users who trusted them. what makes this case worse is where these extensions were found. both were listed on chrome’s official extension marketplace.

How Browser Extensions Steal Your Data A malicious browser extension can steal passwords, session cookies, and email content. learn how to remove risky extensions, revoke sessions, and recover safely. Malicious browser extensions can covertly capture screenshots of the active tab, potentially exposing sensitive data such as credentials, financial transactions, and private communications. If the service worker fails to validate the sender's origin or url, a compromised webpage can send malicious messages, tricking the extension into performing privileged actions (e.g., retrieving sensitive data or api keys). Ox security discovered two malicious extensions – impersonating the legitimate aitopia extension. the malicious extensions exfiltrate chatgpt and deepseek conversations alongside browsing data to attacker controlled servers.

Malicious Chrome Extensions Discovered Stealing Sensitive User Data If the service worker fails to validate the sender's origin or url, a compromised webpage can send malicious messages, tricking the extension into performing privileged actions (e.g., retrieving sensitive data or api keys). Ox security discovered two malicious extensions – impersonating the legitimate aitopia extension. the malicious extensions exfiltrate chatgpt and deepseek conversations alongside browsing data to attacker controlled servers. More than 300 chrome extensions were found to be leaking browser data, spying on users, or stealing user information. Researchers have uncovered 30 chrome extensions stealing user data. here’s how to check your browser and remove any malicious extensions step by step. Recently, multiple incidents have surfaced in which cybercriminals hijacked legitimate chrome extensions to steal user data, inject malicious ads, or deploy malware. this blog post examines these incidents, discusses the risks associated with compromised browser extensions, and offers practical tips for users to safeguard themselves. Cybersecurity researchers have uncovered a sophisticated campaign involving over 40 malicious chrome browser extensions that masquerade as trusted brands to steal sensitive user data.