The hidden threat of Chrome extensions sold that become back doors

In recent weeks, worrying cases of extensions have come to light for Google Chrome that, after being changed hands, have become attack vectors capable of running malicious code and stealing data from users. Two of the affected parts - QuickLens (ID: kdenlnncndfnhkognokfpabggehodd) and ShotBird (ID: gengfhkjekmlejbhmmopegonoifnjp) - they perfectly illustrate a growing problem: the browser extension supply chain can become a back door if a legitimate project is sold or transferred to a malicious actor.

Independent researchers and security firms have documented how, after the transfer of ownership, updates were introduced that maintained the visible functions of the extensions but added mechanisms to inject and execute remote payloads. John Tuckner of Annex Security published a technical analysis that shows, in the case of QuickLens, the ability of the extension to remove security headers in HTTP responses (e.g., X-Frame-Options) and thus make it easier for injected scripts to make arbitrary requests by drawing policies such as Content Security Policy. Your full research can be read on the Annex Security blog ( annex.security).

The delivery method used is particularly stealth: the extension regularly consults a command and control server (C2) to download JavaScript fragments, which do not appear in the static source code of the package. At QuickLens these fragments are stored in the local browser storage and run on each page load by inserting a 1 × 1 hidden image whose onload attribute triggers the code. As Tuckner explains, the malicious code exists only in running time, not in the visible extension files, which complicates your detection by static analysis.

ShotBird, for its part, adopts a similar strategy but with nuances: according to the analysis of monxresearch-sec ( monxresearch-sec), the plugin directly download JavaScript that creates a false Chrome update notification. If the user falls into deception, he is led to a page that instructs him to open the Windows Run box, launch cmd.exe and paste a PowerShell command that ends up downloading an executable called "googleupdate.exe." That binary opens the door to a system-level engagement.

Once active in the browser or on the computer, the abuse chain does not just stay in redirections or in pop-ups: malware binds form elements (input, textwork, select) to capture what the user writes, from passwords to card numbers or government identifiers. In addition, you can access data stored by Chrome - passwords, history, information from other extensions - expanding the scope of the information leak. As a practical summary, this combines remote control of the browser with pivoting towards execution in the host, raising the risk from the theft of credentials to the possible total take of the computer.

The technical patterns and infrastructure observed lead researchers to attribute both campaigns to the same actor: use of the same C2 architecture, clickFix-type lures injected into the pages and transfer of ownership of the extensions as point of entry. The phenomenon is not isolated. In parallel, Microsoft warned about Chromium-based extensions that pose as IA assistants and extract chat histories and navigation data ( Microsoft Defender blog), and other equipment, such as those of Palo Alto Networks Unit 42, have published traces of campaigns where extensions act as remote trojans or carry out large-scale browser hijacking ( Unit 42).

Extensions have also been detected that supplant legitimate services to steal crypto seed phrases by redirecting to phishing pages, as documented by Socket in the case that imitate imToken ( Socket). The framework shows that, in addition to the direct economic incentive, many of these projects are part of membership schemes or coordinated campaigns that re-use infrastructure and techniques.

What can users and organizations do about this type of risk? The first and most urgent thing is to check whether the extensions concerned are installed and, if so, to disinstall them immediately. Google offers instructions to manage and remove supplements in your official help ( Chrome support). At the level of good practice, it is appropriate to avoid installing extensions outside the official store or from unknown developers, to review the permissions that require an extension before they are approved, and to minimize extensions in the browser. If there is suspicion that a malware downloaded code into the system, it is recommended to run an analysis with an updated antivirus, change passwords from a clean device and activate multifactor authentication wherever possible.

For companies and managers, it is recommended to apply centralized control policies on which extensions can be installed (white lists), to audit and block unauthorized installations and to monitor navigation telemetry. Google provides business management tools to manage and restrict extensions in corporate environments; they are worth working with sensitive data or connecting equipment to corporate networks.

The episode of QuickLens and ShotBird shows a clear lesson: a popular and verified complement can no longer be benign at the time of change of owner. The store supports transfers and, unless there is additional control, new owners can publish updates that turn a utility into a mass intrusion mechanism. While platforms and regulators strengthen their controls, the immediate responsibility lies with users, security teams and administrators to inspect and clean their browsers with criteria.

If you want to deepen, here are some resources with technical analysis and monitoring of indicators: the Annex Security report on QuickLens ( annex.security), the study of monxresearch-sec on ShotBird ( monxresearch-sec), the Microsoft Defender alert on malicious extensions of IA ( Microsoft), and the Unit 42 repository that documents campaigns and lists of IOCs ( Unit 42).