Summary:
Five imposter extensions for the Google Chrome web browser masquerading as Netflix viewers and others have been found to track users' browsing activity and profit off retail affiliate programs. The extensions offer various functions such as enabling users to watch Netflix shows together, website coupons, and taking screenshots of a website. The latter borrows several phrases from another popular extension called GoFullPage. The browser add-ons available via the Chrome Web Store and downloaded 1.4 million times are as follows:-[/subscribe_to_unlock_form]
Summary:
Five imposter extensions for the Google Chrome web browser masquerading as Netflix viewers and others have been found to track users' browsing activity and profit off retail affiliate programs. The extensions offer various functions such as enabling users to watch Netflix shows together, website coupons, and taking screenshots of a website. The latter borrows several phrases from another popular extension called GoFullPage. The browser add-ons available via the Chrome Web Store and downloaded 1.4 million times are as follows:-[emaillocker id="1283"]
· Netflix Party (mmnbenehknklpbendgmgngeaignppnbe) - 800,000 downloads
· Netflix Party (flijfnhifgdcbhglkneplegafminjnhn) - 300,000 downloads
· FlipShope – Price Tracker Extension (adikhbfjdbjkhelbdnffogkobkekkkej) - 80,000 downloads
· Full Page Screenshot Capture – Screenshotting (pojgkmkfincpdkdgjepkmdekcahmckjp) - 200,000 downloads
· AutoBuy Flash Sales (gbnahglfafmhaehbdmjedfhdmimjcbed) - 20,000 downloads
The extensions are designed to load a piece of JavaScript that's responsible for keeping tabs on the websites visited and inject malicious code into e-commerce portals, letting the attackers make money through affiliate programs for purchases made by the victims.
References:
The following reports contain further technical details:
https://thehackernews.com/2022/08/experts-find-malicious-cookie-stuffing.html?&m=1
[/emaillocker]