Key Alert:
A recent supply chain attack has compromised several Chrome browser extensions, including a data loss extension from cybersecurity company Cyberhaven. The attackers injected malicious code into legitimate extensions, enabling unauthorized data exfiltration. This incident is part of a broader campaign targeting Chrome extension developers across various companies. Listed below are known exploited extensions that have not been resolved as of now.
Un-resolved extensions:
- YesCaptcha assistant
- Proxy SwitchyOmega (V3)
- VPNCity
- VidHelper
- Uvoice
- Reader Mode
- ParrotTalks
- Keyboard History Recorder
- ChatGPT Assistant
- AI Shop Buddy
- Earny
- Sort By
- Email Hunter
Threat Overview:
The attack involved phishing campaigns that compromised developers’ access to the Chrome Web Store, allowing attackers to publish malicious versions of legitimate extensions. These compromised extensions were then distributed to users, facilitating unauthorized access to sensitive information.
Key aspects of the attack include:
- Targeted Component: Chrome browser extensions from multiple companies, including the data loss prevention extension by Cyberhaven.
- Proof-of-Concept (PoC): The attack was executed through phishing emails that led developers to authorize malicious OAuth applications, granting attackers the necessary permissions to upload compromised extensions.
- Exploitation in the Wild: The malicious extensions were active between December 24 and December 26, 2024, affecting users who had auto-updated their extensions during this period.
Healthcare Impacts:
The compromise of these Chrome extensions presents significant risks to the healthcare sector, including:
- Unauthorized Data Access: The malicious code was designed to exfiltrate cookies and authenticated sessions for specific websites, potentially granting attackers access to sensitive healthcare data, including patient records and protected health information (PHI).
- Credential Theft: By targeting authentication sessions, attackers could harvest credentials for electronic health record (EHR) systems, enabling unauthorized access to critical healthcare applications and patient data.
- Supply Chain Vulnerability Exposure: The attack highlights vulnerabilities in the software supply chain, emphasizing the need for enhanced security measures in the development and distribution of extensions used by healthcare organizations. Compromised extensions could expose organizations to operational disruptions and regulatory penalties.
Exploitation Method:
Attackers initiated the compromise through phishing emails that prompted developers to authorize a malicious OAuth application named “Privacy Policy Extension.” This authorization granted attackers the necessary permissions to upload malicious versions of legitimate Chrome extensions to the Chrome Web Store.
Affected Products and Versions:
- Cyberhaven Chrome Extension: Version 24.10.4 was compromised; the malicious code was active between December 24 and December 26, 2024.
- Other Chrome Extensions: Extensions related to artificial intelligence and virtual private networks (VPNs) were also compromised, indicating a broader impact.
Indicators of Compromise (IoCs):
- Malicious Extension Version: Presence of Cyberhaven Chrome Extension version 24.10.4.
- Unauthorized OAuth Applications: Detection of the “Privacy Policy Extension” OAuth application in developer accounts.
- Suspicious Network Traffic: Outbound connections to the domain cyberhavenext[.]pro, associated with the attacker’s command-and-control server.
Compromised Extension IOCs:
cyberhavenext[.]progptforbusiness[.]siteext[.]businessforai[.]combarefootcontractor[.]comuvoice[.]livecyberhavenext[.]proprimusext[.]proultrablock[.]prodearflip[.]proparrottalks[.]infovidnozflex[.]livewakelet[.]inklocallyext[.]inktinamind[.]infoapple-ads-metric[.]com
geminiaigg[.]problockadsonyt[.]vipfadblock[.]prolltvmarkets[.]comsavgptforchrome[.]probardaiforchrome[.]livecom-freeapps[.]comgpt4summary[.]inksearchaiassitant[.]infoartseasy[.]comsavechatgpt[.]siteupwordwave[.]comyescaptcha[.]provideodownloadhelper[.]printernetdownloadmanager[.]prosearchgptchat[.]inf
gptdetector[.]livechatgptextent[.]proyoutubeadsblocker[.]livechatgptextension[.]siteremiwantnun[.]comokta-onsolve[.]comcapitalizerutc[.]comextensionpolicyprivacy[.]compolicyextension[.]infoextensionpolicy[.]netcheckpolicy[.]sitelinewizeconnect[.]comextensionbuysell[.]comadskiper[.]netaiforgemini[.]com
aeromexi[.]cogptforads[.]infoblockforads[.]comytbadblocker[.]comsearchcopilot[.]cocastorus[.]infobookmarkfc[.]infoproxyswitchyomega[.]prographqlnetwork[.]proiobit[.]propieadblock[.]prosclpfybn[.]comtnagofsg[.]comkra18[.]com
IPV4 IOCs:
149.28.124.8445.76.225.148136.244.115.219149.248.44.88108.61.23.19280.240.21.3645.32.69.11155.138.253.165
45.77.5.196144.202.123.8674.220.199.945.32.231.212149.28.117.236137.220.48.214149.248.2.160
Known Compromised Extension IDs:
bibjgkidgpfbblifamdlkdlhgihmfohhpkgciiiancapdlpcbppfkmeaieppikkkepdjhgbipjpbbhoccdeipghoihibnfjabbdnohkpnbkdkmnkddobeafboooinplabefflofjcniongenjmbkgkoljhgliihecedgndijpacnfbdggppddacngjfdkacannpnnpemnckcfdebeekibpiijlicmpomdpggmcodlahmljkhlmpgpdcffdaoccnicplhlgabfijoiabgkigdafklbhhdkahjmiglaibdlgminlepgeifekifakochlkambindhfolmpijhodmgkloeeppmkhpmhceaijffijbobmnonfhilihbejadplhddo
ndlbedplllcgconngcnfmkadhokfaalnigbodamhgjohafcenbcljfegbipdfjpkbgejafhieobnfpjlpcjjggoboebonfcgllimhhconnjiflfimocjggfjdlmlhblmhodiladlefdpcbemnbbcpclbmknkiaemepikoohpebngmakjinphfiagogjcnddmpajkjnmeojmbapicmbpliphjmcekeaacogbhbgkiojdollpjbhbamafmedkeockbeanofdhdfbcalhflpbdipkjjkoimeeodlbneaaedflankmgmfbmaplggbmjjmbaehmiaoahjllhfgebflooeeefeiafpkfdepdkmmfdfggfpibdjbbghggcllhhainjo
acmfnomgphggonodopogfbmkneepfgnhmnhffkhmpnefgklngfmlndmkimimbphcoaikpkmjciadfpddlpjjdapglcihgdlefbmlcbhdmilaggedifpihjgkkmdgeljhkkodiihpgodmdankclfibbiphjkfdenhoeiomhmbaapihbilkfkhmlajkeegnjhejiofmdifioeejeilfkpegipdjiopieklhihblcmlaaademjlakdpicchbjnnnkboegmennebgadmncfjafcemlecimkepcleemedckhdnioeieppmeojgegjfkhdlaeodidhgeamncokiaegffipckhhcpnmlcblekpkdmohpdnebfedjjfklhpefgpgaaji
MITRE Tactics, Techniques, and Procedures (TTPs):
| Tactics | Techniques |
|---|---|
| Initial Access | Phishing: Spear Phishing Link (T1566.002) |
| Execution | User Execution: Malicious File (T1204.002) |
| Persistence | Implantation of Malicious Browser Extensions (T1176) |
| Credential Access | Steal Application Access Tokens (T1550.004) |
| Command and Control | Application Layer Protocol: Web Protocols (T1071.001) |
Recommendations for Healthcare Organizations:
Immediate Actions:
- Update Extensions: Ensure all Chrome extensions are updated to their latest versions, particularly those identified as compromised.
- Revoke Unauthorized OAuth Applications: Review and remove any unauthorized OAuth applications, such as the “Privacy Policy Extension,” from developer accounts.
- Monitor Network Traffic: Implement monitoring for connections to known malicious domains, including cyberhavenext[.]pro.
Long-Term Defense:
- Use Trusted Sources and Tools for Vetting Extensions: Rely on reputable browser stores and third-party security tools to vet extensions before installing them. Look for extensions with high ratings, detailed reviews, and transparent developer information. Avoid installing extensions from unknown or unverified sources.
- Enable Multi-Factor Authentication (MFA) Where Possible: For any services or applications accessed through browser extensions, enable MFA to secure accounts even if the extension is compromised. This adds an additional layer of defense against unauthorized access.
- Conduct Regular Security Audits: Perform periodic reviews of browser extensions and associated OAuth applications to detect and mitigate potential vulnerabilities.
Leadership Guidance:
Organizational leaders should prioritize implementation of appropriate security policies. Developing policies that vet and clear extensions prior to installation by users. Additionally leadership can consider disabling automatic updates to ensure malicious code is not automatically installed.
Blackwell Security MHXDR Customers:
If Blackwell is receiving endpoint logs we are looking for Event ID 4663, Event ID 4688, and inspecting process creation linked to Chrome or Edge activity, as well as monitoring for IOCs listed above which have been added to our internal threat intelligence platform. If you observe abnormal browser behavior, high CPU usage, or crash dumps referencing chrome.dll, please contact the Blackwell IR team immediately. Note: Although this exploit specifically covers the CyberHaven extension, the original report also indicates the same technique has been used to target other extensions as well. Even if Cyberhaven is not a used extension if users experience similar abnormal browser behavior reach out to Blackwell IR team.
References:
Cyberhaven Extension Compromise
Cyberhaven’s Chrome extension security incident and what we’re doing about it
When Chrome Extensions Turn Against Us: The Cyberhaven Breach and Beyond
Cybersecurity firm’s Chrome extension hijacked to steal users’ data
Cyberhaven IncidentOngoing Updates
Blackwell is cybersecurity made for healthcare.
Our comprehensive security platform and expert managed services provide the most complete protection for healthcare organizations. Leading providers across North America trust Blackwell to reduce cyber risk, stay compliant, and build trusted experiences across the care continuum.
© 2025 Blackwell Security | Privacy Policy | Sitemap