On December 27, 2024 cybersecurity firm Cyberhaven disclosed an attack against its browser extension resulting in the release of a malicious version that was available for just over a day before it was discovered and taken down. In their disclosure, Cyberhaven explained that the threat actor sent an employee a phishing email that spoofed Google Chrome Web Store Developer Support and urged the employee to click a link to accept developer program policies and grant permissions to a malicious application named “Privacy Policy Extension”. With permissions granted, the attacker uploaded a malicious version of the Chrome extension to the web store which included code built to communicate with a command-and-control server, download additional configuration files, and exfiltrate user data. Upon this discovery, cybersecurity researchers also unveiled additional extensions that have potentially been similarly compromised, indicating that the attack on Cyberhaven is part of a broader campaign. Researchers have published the names and versions of over thirty (30) other browser extensions that have likely been compromised. Analysis of the code found in the malicious Cyberhaven extension reveals that it targets exfiltration of identity data and access tokens of Facebook accounts primarily. The code listens for mouse click events on the facebook[.]com website and checks for images containing the string “qr/show/code” in the src attribute. Researchers believe that the intent of this code is to search for QR codes related to two-factor authentication requests. CTIX analysts recommend that individuals and organizations review the list of potentially compromised extensions to ensure they are not impacted. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.