Delete These 16 Google Chrome Extensions Now: Massive Cyberattack Targets Over 3.2 Mn Users; Check List

In a major cyberattack on Google Chrome, 16 popular Chrome extensions were reportedly taken over through a network of rogue browser extensions, compromising over 3.2 million users. The Chrome extensions compromised include ‘Adblock for Chrome’ and ‘WAToolkit’.

According to a report by Notebookcheck, it was discovered that these extensions, which purposefully appear to be authentic, were actually collecting data, inserting malicious scripts, and even participating in search engine fraud. 

The massive cyberattack was carried out through a supply chain hack, according to researchers, in which the attackers compromised trusted extensions and distributed malicious updates without the victims’ knowledge.

Even though they have all been taken down from the Chrome Web Store, if any of the 16 extensions listed below are still installed in your browser, you will need to manually remove them:

• WAToolkit

• Blipshot (one click full page screenshots)

• Video Effects for YouTube and Audio Enhancer

• Themes for Chrome and YouTube Picture in Picture

• Emojis (Emoji keyboard)

• Emoji Keyboard Emojis for Chrome

• Colour Changer for YouTube

• Mike Adblock für Chrome | Chrome-Werbeblocker

• Adblock for You

• Adblock for Chrome

• Adblocker for Chrome (NoAds)

• Page Refresh

• Wistia Video Downloader

• Super Dark Mode

• Nimble Capture

• KProxy

The aforementioned extensions serve a variety of purposes, including screen capture, emoji keyboards, and ad blocking. However, hidden scripts are part of updates made it possible to inject ads onto webpages, alter HTTP requests, and exfiltrate data without authorisation.

Because users had previously given rights to these extensions, they were unaware of all these changes, and attackers were able to control online activities in real time. Notably, these extensions were considered risky by experts due to the permissions given to them, such as host access and scripting controls.

The attack was linked to compromised developer accounts. Unaware of the looming danger, some developers gave the attackers authority over their extensions, which were used to spread malicious updates via the official browser extension store.

Uninstall an extension:

1. To the right of your address bar, look for the extension's icon.

2. Right-select the icon and select Remove from Chrome. 

If you don't find the extension's icon: 

1. On your computer, open Chrome. 

2. At the top right, select More: > and then Extensions > and then Manage extensions. 

3. On the extension you want to remove, select Remove. 

4. To confirm, select Remove.